Quick shorten a URL

Minimal shortener that works with or without authentication. Returns a slim object, not a Link. No link.create webhook is sent.

Auth: optional. With an Authorization header it must be a valid API key or MCP OAuth access token (an invalid one is a 401, never an anonymous fallback). With no header, a signed-in dashboard session cookie counts as authenticated. With neither, the request is anonymous: the link is created on Flyn's anonymous short domain and expires after 24 hours.

Bot check (anonymous and session callers): requests without an Authorization header must send an Accept header and a User-Agent of at least 10 characters that does not look like a bot, crawler or HTTP library (curl, wget, python-requests, Postman and similar), else 403.

Plan: no Pro-field gating here. The plan is the effective plan for an API key or OAuth token (a member of a paying owner's workspace has team), but the member's own plan for a session-cookie caller, whose links are always personal, never team links. On Free the cap is 25 links per UTC month, counted per user (429 MONTHLY_LIMIT); when a Free key or token acts in a team, the database also counts the team's links this month and fails the create with 500 once the team has 25. Pro, Lifetime and team are uncapped. Anonymous callers get 5 requests per IP per 24-hour fixed window that starts at their first request (in memory per server instance). Every anonymous request that passes the bot check and the per-minute limit counts, including ones that then fail validation (429 DAILY_LIMIT).

Rate limit: 5 requests per 60 s per IP anonymous, 30 authenticated, in one shared bucket per IP (fixed window, in memory per server instance). Each per-minute 429 also blocks the IP for 60 s; requests during the block get 429 with Retry-After set to the seconds left. (Only overlapping requests that carry a dashboard session cookie can stretch a block to 300 s or more.) X-RateLimit-* headers are sent only on the 200 and on the per-minute 429.