ShortyyDocs
Dashboard

Introduction to Shortyy

Developer-first URL shortening and redirect management platform engineered for microsecond latency, cryptographic API key security, and seamless multi-language developer integration.

Introduction to Shortyy

Welcome to Shortyy, an enterprise-grade, developer-first URL shortener built from the ground up for extreme speed, developer autonomy, and cryptographic integrity.

Shortyy is engineered for developers, engineering teams, and platform architects who need deterministic short link generation, immutable redirect security, and deep observability across their distribution pipelines.

Why Shortyy?

Most URL shorteners treat short links as mutable database rows that anyone with admin access can silently redirect or recycle. Shortyy is built on fundamentally different invariants:

▪
Immutable Short Links: Once created, short links can never have their destination URL silently altered. If a target changes, you must delete the short code and mint a new one.
▪
Permanent Tombstone Reservation: When a link expires or is deleted, its code is permanently transferred into an immutable graveyard (reserved_codes). It can never be recycled, hijacked, or claimed by another user or attacker.
▪
Cryptographically Secure API Keys: High-entropy keys prefixed with sh_live_ and hashed with SHA-256 before persistence. Plaintext keys are never stored on disk.
▪
Token-Bucket Rate Limiting: Abuse prevention that respects developer workflows with generous burst capacity and continuous per-second token replenishment instead of punitive arbitrary lockouts.
▪
Language-Independent REST Architecture: A first-class public REST API that behaves identically whether consumed through our official TypeScript SDK, Python, Go, Java, PHP, or raw cURL.

Architectural Principles

Shortyy's platform is governed by three non-negotiable architectural axioms:

PrincipleInvariant GuaranteePurpose
Zero Silent MutationNo PATCH or update endpoints exist on link destinations.Protects brand trust and eliminates redirect tampering attacks.
Code PermanenceCodes enter immutable tombstone status upon deletion.Prevents phishing takeovers of dead marketing links.
Ephemeral Playground SecurityInteractive API keys live strictly in client memory.Guarantees zero credential leakage to browser storage or telemetry.

Technology Stack

Shortyy runs on a distributed modern cloud infrastructure:

▪
Edge & API Layer: Fastify high-throughput Node.js microservice architecture with asynchronous non-blocking I/O.
▪
Cache & Rate Limiter: Upstash distributed Redis clusters utilizing sub-millisecond in-memory caching and Redis Lua scripts for atomic token-bucket replenishment.
▪
Persistence & Auth: Supabase PostgreSQL with Row Level Security (RLS) and granular role-based access control.
▪
Frontend & Documentation: Next.js 16 with React 19, Server Components, and Tailwind CSS.

Next Steps

▪
Follow the Quickstart Guide to create your first link in under 2 minutes.
▪
Learn about Authentication & API Keys to provision your production credentials.
▪
Explore the Interactive REST API Playground to test live requests directly in your browser.