---
title: "QR code for the share link"
method: GET
path: "/api/v1/files/{uuid}/qr-code"
tags: ["Files"]
---

# QR code for the share link

`GET /api/v1/files/{uuid}/qr-code`

## Request

- Base URL: `https://everypage.co`
- URL: `https://everypage.co/api/v1/files/{uuid}/qr-code`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://everypage.co/oauth/authorize`, token URL `https://everypage.co/oauth/token`, scopes: `files:read`)

Bearer-authed twin of the public `/api/files/{uuid}/qr-code` endpoint, returning the same PNG. There is NO ownership check: any valid credential with `files:read` can fetch the QR of any live file id, because the image only encodes the public share URL (durable short-id form on the owner's custom domain when verified, never the slug, with `?via=qr` so scans show up in the readership source breakdown). Unknown, expired, trashed or burned ids answer 404. Cached for a day (`Cache-Control: public, max-age=86400`). When handing a QR URL to a third party (an email, a Zap output, a downstream app), use the public path - it needs no Authorization header. The response is binary - hand the URL to the user rather than returning the bytes to a model.

## Response `200`

PNG QR code encoding the share URL

## Other responses

- `401`: No or invalid API key, OAuth token, manage token or claim token (code `missing_token` or `invalid_token`).
- `404`: Unknown id, or a file you do not own on routes where 404 replaces 403 (code `not_found`).
- `429`: Over the limit - 120 requests per minute per Authorization value on /api/v1 (webhook test 10/min; the Canva lane 30/min per IP). Code `rate_limited`; wait for `Retry-After`.

---

[API](https://skmtc.dev/everypage/apis/everypage-api.md) · [All operations](https://skmtc.dev/everypage/apis/everypage-api/llms.txt) · [OpenAPI document](https://skmtc.dev/everypage/apis/everypage-api/revisions/e6674f903456?raw)