> ## Documentation Index > Fetch the complete documentation index at: https://uselora.dev/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve QR code > Generates a PNG image of a QR code for the given URL. Accepts both anonymous and Bearer-authenticated callers; anonymous responses encode a `lora-links.com` redirect URL, authenticated responses encode the destination verbatim and may use `hideLogo` on Basic / Business / Enterprise plans. ## OpenAPI ````yaml /openapi.json get /v1/qr openapi: 3.1.0 info: title: Lora API version: 1.0.0 description: Internal API for managing company short links servers: - url: https://api.uselora.com description: Production security: - bearerAuth: [] paths: /v1/qr: get: tags: - QR Codes summary: Retrieve QR code description: >- Generates a PNG image of a QR code for the given URL. Accepts both anonymous and Bearer-authenticated callers; anonymous responses encode a `lora-links.com` redirect URL, authenticated responses encode the destination verbatim and may use `hideLogo` on Basic / Business / Enterprise plans. operationId: getQRCode parameters: - name: url in: query required: true description: >- The URL to generate a QR code for. Anonymous calls encode this destination behind a `lora-links.com` redirect (so Lora can layer analytics and abuse-blocking on the public flow); authenticated calls (Bearer API key) encode it verbatim. schema: type: string maxLength: 32000 - name: size in: query required: false description: >- The size of the QR code in pixels (64-2048). Defaults to `600` if not provided. schema: default: 600 type: integer - name: level in: query required: false description: >- The level of error correction to use for the QR code. Defaults to `L` if not provided. schema: default: L type: string enum: - L - M - Q - H - name: fgColor in: query required: false description: >- The foreground color of the QR code in hex format. Defaults to `#000000` if not provided. schema: default: '#000000' type: string - name: bgColor in: query required: false description: >- The background color of the QR code in hex format. Defaults to `#ffffff` if not provided. schema: default: '#FFFFFF' type: string - name: hideLogo in: query required: false description: >- Whether to hide the Lora logo overlay in the QR code. Requires an authenticated request (`Authorization: Bearer …`) with an API key on a Basic, Business, or Enterprise plan. Anonymous calls and keys without the `removeWatermark` capability receive `403 plan_requires_upgrade`. schema: default: false type: boolean - name: margin in: query required: false description: >- The size of the margin around the QR code in modules (0-20). Defaults to 2 if not provided. schema: default: 2 type: integer responses: '200': description: The QR code as PNG bytes. content: image/png: schema: type: string format: binary '400': description: The request failed validation. content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Sentry trace ID when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '401': description: >- Sent an `Authorization` header but the Bearer token was missing, malformed, unknown, expired, or disabled. The body uses the standard error envelope; the response intentionally doesn't disclose which failure mode occurred. content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Sentry trace ID when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '403': description: >- Requested `hideLogo=true` from an anonymous caller or from an API key whose plan lacks the `removeWatermark` capability. Body carries `code: "plan_requires_upgrade"`, `current_plan` (e.g. `"basic"`, `"business"`, or the literal `"anonymous"`), and `required_capability: "removeWatermark"`. content: application/json: schema: type: object properties: error: type: string code: type: string const: plan_requires_upgrade description: >- Always the literal string `plan_requires_upgrade`. Clients can switch on this value to surface an upgrade CTA. current_plan: type: string description: >- The plan tier the caller is currently on (e.g. `"basic"`, `"business"`), or the literal `"anonymous"` for unauthenticated callers. required_capability: type: string description: >- The plan-capability key the requested feature needs. Today emitted as `"removeWatermark"` from `/v1/qr` when `hideLogo=true` is requested without a plan that grants it. requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Sentry trace ID when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - code - current_plan - required_capability - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '429': description: >- Rate limit exceeded. Anonymous callers share a per-IP budget (60 requests/minute, sliding window). Authenticated callers are bucketed by the workspace's per-key cap (600/minute on Basic, 1500/minute on Business). Requests that present an `Authorization` header are additionally subject to a per-IP cap on failed verification attempts (60/minute, sliding window): once an IP exhausts that budget, further requests with an unverified Bearer token receive this 429 before the key is checked, and valid keys never count toward it. The body uses the standard error envelope with `code: "rate_limit_exceeded"`. The `Retry-After` response header contains the number of seconds (≥ 1, ≤ window) the client should wait. The 429 response is never CDN-cached (`Cache-Control: no-store`) so a single blocked edge POP doesn't lock out every visitor behind it. headers: Retry-After: description: >- Seconds the client should wait before retrying. Always a positive integer, never larger than the rate-limit window. schema: type: integer minimum: 1 maximum: 60 Cache-Control: description: >- Always `no-store` on the 429 response so a CDN POP can't memoize the denial and lock out every visitor behind it until the cache entry expires. schema: type: string enum: - no-store X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string content: application/json: schema: type: object properties: error: type: string code: type: string const: rate_limit_exceeded description: >- Always the literal string `rate_limit_exceeded`. Clients can switch on this value to surface a back-off UX. requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Sentry trace ID when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - code - requestId additionalProperties: false '500': description: Internal Server Error content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Sentry trace ID when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string security: - {} - bearerAuth: [] components: securitySchemes: bearerAuth: type: http scheme: bearer ````