> ## Documentation Index
> Fetch the complete documentation index at: https://docs.linquid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Public and Embed APIs

> Public stats and embeddable widget token/data endpoints

# Public and Embed APIs

These endpoints power:

* public shareable link analytics
* authenticated embed token issuance
* embeddable widgets for stats/referrals/link creation

## Public stats endpoints (`/public/stats/*`)

* `GET /public/stats/:domain/:key`
* `GET /public/stats/:key`

Behavior:

* No auth required.
* Link must exist, domain must match, and `publicStats` must be enabled.
* Returns link summary + clicks/timeseries + geo/device/browser/referrer breakdowns.

## Embed endpoints (`/embed/*`)

* `POST /embed/token`
* `GET /embed/verify`
* `GET /embed/data/stats`
* `GET /embed/data/referrals`
* `POST /embed/data/create-link`
* `GET /embed/widget.js`
* `POST /embed/track`

## Token model (`POST /embed/token`)

Token `type` options:

* `stats`
* `referrals`
* `link-creator`

Token TTL:

* min `300s` (5 minutes)
* max `86400s` (24 hours)

Optional scoping:

* `linkId`
* `campaignId`

## Authorization model

* token generation is authenticated and permission-gated
* read widget tokens require read-level permissions
* link-creator tokens require link-creation permissions

Data endpoints validate token signature and expiry before returning content.

## Link-creator protections

`POST /embed/data/create-link` includes:

* token verification + type check
* URL validation rules
* workspace/campaign ownership checks
* IP-based rate limiting for creation attempts

## Typical failures

* `401 UNAUTHORIZED`: invalid/expired token
* `403 FORBIDDEN`: missing permissions for token creation
* `404 NOT_FOUND`: missing scoped link/campaign
* `429 RATE_LIMITED`: embed create-link abuse protection

Related docs:

* `/user-guides/manual/data/exports-and-operational-checks`
* `/user-guides/manual/data/analytics-views-reference`