Create QR Codes From Your Own App With a REST API: A 10-Minute Guide

2026-10-12 api developers automation

To create QR codes from your own system, send one authenticated POST to the QR Maker REST API with the destination URL and your own reference ID, then render the short link it returns. Use the reference ID to make retries safe, request the SVG in the same call, and PATCH the destination later when the page changes. The API is available on the Business plan and is meant to be called from your server, not from a browser.

What you need

A Business plan and an API token. Create the token in the Settings page, under API Tokens, and copy it when it is shown: it starts with qrs_ and is only displayed once. Pick the read-only scope for tokens that only pull reports.
A server-side environment. The API does not allow cross-origin browser calls, so keep the token on your server.
A stable reference for each code in your own system, such as an order number, a SKU or a referral code. This becomes the external_id.

The base URL is https://qrmaker.ai/api/v1, and every request carries Authorization: Bearer qrs_....

Step 1: create a code

curl -X POST "https://qrmaker.ai/api/v1/qrcodes?include=svg" \
  -H "Authorization: Bearer $QR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "target_url": "https://shop.example.com/product/AB12CD?ref=qr",
    "external_id": "AB12CD",
    "name": "Product AB12CD",
    "folder": "spring-campaign"
  }'

Only target_url is required. The response contains the code, including a short_link such as https://qrmk.cc/hzu23X, and, because of ?include=svg, the SVG markup in the svg field. The short link is the only thing that should be encoded into the picture or shared. Changing target_url later does not change the picture.

Step 2: make retries safe with external_id

Networks fail, and jobs run twice. If you send the same external_id with the same target_url again, the API does not create a second code: it returns the existing one with a 200 status and an X-Idempotent-Replay: true header. A different target_url for an existing external_id returns 409, so a retry can never quietly change where a printed code goes.

Step 3: use the SVG

Store or serve the SVG as it is. It scales to any print size and works in an img tag. To fetch it later, call GET /v1/qrcodes/{id}/svg with optional size and margin parameters; the response carries an ETag, so you can cache it and only re-download when the style changes. The API does not produce PNG files. If you need PNG, convert the SVG in your own system.

Step 4: change the destination without reprinting

curl -X PATCH "https://qrmaker.ai/api/v1/qrcodes/by-external-id/AB12CD" \
  -H "Authorization: Bearer $QR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "target_url": "https://shop.example.com/product/AB12CD-v2" }'

You can look codes up by your own reference, so you do not need to store QR Maker's ID at all. The new URL goes through the same safety checks as one entered on the website.

Step 5: read the results

GET /v1/qrcodes/{id}/analytics returns scans, unique visitors per day, and breakdowns by country, device, operating system, browser, referrer, language and placement tag, for a date range and time zone you choose. GET /v1/analytics/summary aggregates many codes in one call, which avoids one request per code. If you prefer a feed, GET /v1/scans returns new scan events in order, and you store the last next_since_id you saw.

Rate limits and quotas

Each account can make 120 API requests a minute, shared by all of its tokens, and each response includes headers showing the remaining budget. The Business plan includes 50,000 successful requests a month; requests that fail with a 4xx or 5xx status do not count. For bulk jobs, POST /v1/qrcodes/batch creates up to 100 codes per request, each one idempotent on its own.

A small Node example

const res = await fetch('https://qrmaker.ai/api/v1/qrcodes?include=svg', {
  method: 'POST',
  headers: { Authorization: `Bearer ${process.env.QR_TOKEN}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({ target_url: url, external_id: orderId }),
})
if (!res.ok) throw new Error(`QR API ${res.status}: ${(await res.json()).code}`)
const { data } = await res.json()
// data.short_link is what the printed code encodes; data.svg is the picture

Rely on the stable code field in error responses rather than the human-readable message.

Where to go next

The API reference lists every endpoint and error code, and the overview page links to the OpenAPI file, the Postman collection and complete example programs. To create codes without writing a server, see the guides for Google Sheets and for Make, n8n and Zapier.

FAQ

Can I call the API from the browser?

No. Browsers calling the API directly would expose your token to every visitor. Call it from your server and pass the SVG or short link to the page.

What happens if my token leaks?

Revoke it in Settings and create a new one. Tokens can only call the QR code API, not change your password, billing or domains, and a read-only token cannot create, change or delete anything.

Can the codes use my own domain?

Yes. On the Business plan you can connect one custom short-link domain. Pass it as short_domain when you create a code, and the short link uses your domain instead of the shared one.