QR code image API

Everything after /qr/ is the payload, including its own query string. The server URL-decodes it, encodes it as a QR code and streams back an image. With no options that is a 512-pixel black-on-white PNG at error correction M with a 2-module quiet zone. There is no shortener and no redirect: the code contains your URL literally, so it keeps working even if this site does not.

Options are query parameters: ?size=1024, ?dark=7c3aed&light=transparent, ?format=svg. Nothing is stored and nothing is trusted — every value is checked against a fixed range, so a bad one returns 400 with a message naming the parameter rather than being silently ignored.

Responses carry Cache-Control: public, max-age=86400 and an open CORS header, so a repeated link is served from cache and the image can be fetched from your own JavaScript. Because the cache key is the entire URL, two different option sets are two different cached images.

The payload lives in the path, so a URL with its own ? and & works without escaping: /qr/https://shop.example/p?id=42&ref=poster encodes exactly that address. Only the eight names in the table above are taken as options, matched exactly and case-sensitively; every other parameter stays part of what gets encoded.

That leaves one honest collision: a target URL that itself carries size, margin, ec, dark, light, format, download or data. In /qr/https://shop.example/p?size=XL the request cannot tell your parameter from ours, and size=XL is read as an option — which fails with a 400. Two ways out, both exact:

The endpoint is free and unauthenticated, which only works if people are reasonable about it. It is sized for embedding codes in documents, dashboards and emails — not for bulk-rendering hundreds of thousands of images. If you need that volume, the same library that powers this endpoint, node-qrcode, runs happily on your own machine, and this site's terms explain what counts as abuse.

A PNG stops at 1024 pixels because rendering is not free and nobody has to log in to ask for it: a bitmap is drawn pixel by pixel on a single-threaded server, so the cost climbs with the area and a few large concurrent requests would slow the whole site down. An SVG has no such cost — the size only lands in a width and height attribute — so format=svg runs to 2048 pixels and scales past that without blurring, which is what print work wants anyway. Ask for a larger PNG and you get a 400 that says so and names format=svg. The one thing the API deliberately does not do is the centred logo overlay: that needs your image file, so it lives in the QR code generator, where compositing happens in your browser. Pair it with ec=h so the code survives the covered modules.