QRburst

API Reference

Contract for authenticated POST /api/v1/qr. Machine-readable: /openapi.json. This describes the future/private contract — the API is not publicly available unless the status banner says otherwise.

Developer API — Not currently available for public access. QRburst's developer API is designed for authenticated access and is currently disabled while the access model is being prepared. The browser generator is unaffected and needs no API key.

Authentication

When enabled, every generation request requires:

Authorization: Bearer qrb_live_YOUR_API_KEY
  • Keys are manually provisioned — there is no public key signup.
  • Do not send keys in query strings, cookies, or JSON bodies.
  • Missing or invalid credentials → HTTP 401 with the same generic message.

POST /api/v1/qr

JSON body → raw image response. Cache: no-store. Max body 32 KB. Unknown JSON fields are rejected.

{
  "payload": {
    "type": "website",
    "url": "https://example.com"
  },
  "output": {
    "format": "png",
    "size": 512
  },
  "design": {
    "errorCorrection": "H"
  }
}

Public payload discriminator website maps to the canonical internal URL payload. Event times are floating local YYYY-MM-DDTHH:mm (same as the website tool).

Payload types

  • website, text, email, phone, sms, whatsapp
  • wifi, vcard, location, event

Encoding reuses the same canonical validators/encoders as the browser product. Logos, gradients, and advanced module styles are not available via API v1.

Errors

Errors are JSON. Unauthorized: 401. Invalid requests: 400. Oversized bodies: 413. Wrong content type: 415. Rate limit: 429. Generation failures: 500. API disabled or misconfigured limiter/keys: 503. Payload values and API keys are not echoed in error messages.

{
  "error": {
    "code": "unauthorized",
    "message": "A valid API key is required.",
    "requestId": "…"
  }
}

Rate limits

  • POST: 30 requests / 60s / API key (initial safety quota)
  • Response includes Retry-After when limited

CORS: Access-Control-Allow-Origin: * for POST and OPTIONS, with Authorization allowed. Credentials (cookies) are not supported — Bearer tokens travel in the Authorization header.

Examples

Examples use the placeholder qrb_live_YOUR_API_KEY. They are not live credentials.

curl

curl -X POST "https://qrburst.com/api/v1/qr" \
  -H "Authorization: Bearer qrb_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"payload":{"type":"website","url":"https://example.com"},"output":{"format":"png","size":512},"design":{"errorCorrection":"H"}}' \
  --output qr.png

JavaScript

const res = await fetch("https://qrburst.com/api/v1/qr", {
  method: "POST",
  headers: {
    "Authorization": "Bearer qrb_live_YOUR_API_KEY",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    payload: { type: "website", url: "https://example.com" },
    output: { format: "png", size: 512 },
  }),
})
const blob = await res.blob()

Node.js

const res = await fetch("https://qrburst.com/api/v1/qr", {
  method: "POST",
  headers: {
    Authorization: "Bearer qrb_live_YOUR_API_KEY",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    payload: { type: "website", url: "https://example.com" },
    output: { format: "png", size: 512 },
  }),
})
const buf = Buffer.from(await res.arrayBuffer())
await import("node:fs/promises").then((fs) => fs.writeFile("qr.png", buf))

Next.js (server)

export async function GET() {
  const res = await fetch("https://qrburst.com/api/v1/qr", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.QRBURST_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      payload: { type: "website", url: "https://example.com" },
      output: { format: "png", size: 512 },
    }),
    cache: "no-store",
  })
  const bytes = await res.arrayBuffer()
  return new Response(bytes, { headers: { "Content-Type": "image/png" } })
}

React

// Prefer calling from your backend so the API key is never embedded in the browser.
async function loadQrFromYourApi() {
  const res = await fetch("/your-backend/qr")
  return URL.createObjectURL(await res.blob())
}

Laravel / PHP

use Illuminate\Support\Facades\Http;

$response = Http::withToken('qrb_live_YOUR_API_KEY')
    ->accept('image/png')
    ->withBody(json_encode([
        'payload' => ['type' => 'website', 'url' => 'https://example.com'],
        'output' => ['format' => 'png', 'size' => 512],
    ]), 'application/json')
    ->post('https://qrburst.com/api/v1/qr');

file_put_contents('qr.png', $response->body());

Python

# Uses the requests library (pip install requests)
import requests

r = requests.post(
    "https://qrburst.com/api/v1/qr",
    headers={"Authorization": "Bearer qrb_live_YOUR_API_KEY"},
    json={
        "payload": {"type": "website", "url": "https://example.com"},
        "output": {"format": "png", "size": 512},
    },
)
r.raise_for_status()
open("qr.png", "wb").write(r.content)
QRburst API Reference