> ## Documentation Index > Fetch the complete documentation index at: https://uselora.dev/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve QR code > Generates a PNG image of a QR code for the given URL. Accepts both anonymous and Bearer-authenticated callers; anonymous responses encode a `lora-links.com` redirect URL, authenticated responses encode the destination verbatim and may use `hideLogo` on Basic / Business / Enterprise plans. ## OpenAPI ````yaml /openapi.json get /v1/qr openapi: 3.1.0 info: title: Lora API version: 1.0.0 description: >- Lora REST API for managing workspace shortcuts, folders, tags, and QR codes. ## Versioning All stable endpoints are prefixed with `/v1/`. Breaking changes ship under a new path prefix (for example `/v2/`). Non-breaking additions (new optional fields, new endpoints) may land in the current version. Deprecated endpoints are announced in the [developer docs](https://uselora.dev) before removal. ## Authentication Send `Authorization: Bearer ` on every request except `GET /v1/qr`, which also accepts anonymous callers. API keys are workspace-scoped and carry OAuth-style scopes (for example `shortcuts.write`). ## Errors 4xx and 5xx responses use a typed JSON envelope: `{ error, code?, requestId, traceId?, fieldErrors?, required_scope?, current_plan?, required_capability? }`. See components `ErrorResponse`, `ErrorWithFieldErrors`, `PaymentRequiredError`, `ForbiddenError`, and `InternalError`. ## Rate limits Successful responses include `RateLimit-Limit`, `RateLimit-Remaining`, and `RateLimit-Reset` (IETF RateLimit fields). 429 responses include `Retry-After` (seconds). Authenticated callers are bucketed per API key; anonymous QR endpoints are bucketed per IP. ## Discovery - OpenAPI spec: `GET https://api.uselora.com/openapi.json` (also `GET https://api.uselora.com/`) - RFC 9727 catalog: `GET https://www.uselora.com/.well-known/api-catalog` - MCP manifest: `GET https://www.uselora.com/.well-known/mcp` (server card at `/.well-known/mcp/server-card.json`) - MCP Streamable HTTP endpoint: `POST https://api.uselora.com/mcp` servers: - url: https://api.uselora.com description: Production security: - bearerAuth: [] paths: /v1/qr: get: tags: - QR Codes summary: Retrieve QR code description: >- Generates a PNG image of a QR code for the given URL. Accepts both anonymous and Bearer-authenticated callers; anonymous responses encode a `lora-links.com` redirect URL, authenticated responses encode the destination verbatim and may use `hideLogo` on Basic / Business / Enterprise plans. operationId: getQRCode parameters: - name: url in: query required: true description: >- The URL to generate a QR code for. Anonymous calls encode this destination behind a `lora-links.com` redirect (so Lora can layer analytics and abuse-blocking on the public flow); authenticated calls (Bearer API key) encode it verbatim. schema: type: string maxLength: 32000 examples: - https://example.com - name: size in: query required: false description: >- The size of the QR code in pixels (64-2048). Defaults to `600` if not provided. schema: default: 600 type: integer - name: level in: query required: false description: >- The level of error correction to use for the QR code. Defaults to `L` if not provided. schema: default: L type: string enum: - L - M - Q - H - name: fgColor in: query required: false description: >- The foreground color of the QR code in hex format. Defaults to `#000000` if not provided. schema: default: '#000000' type: string - name: bgColor in: query required: false description: >- The background color of the QR code in hex format. Defaults to `#ffffff` if not provided. schema: default: '#FFFFFF' type: string - name: hideLogo in: query required: false description: >- Whether to hide the Lora logo overlay in the QR code. Requires an authenticated request (`Authorization: Bearer …`) with an API key on a Basic, Business, or Enterprise plan. Anonymous calls receive `403 plan_requires_upgrade`; a valid Free-plan key receives `402 plan_requires_upgrade` before QR options are evaluated. schema: default: false type: boolean - name: margin in: query required: false description: >- The size of the margin around the QR code in modules (0-20). Defaults to 2 if not provided. schema: default: 2 type: integer responses: '200': description: The QR code as PNG bytes. content: image/png: schema: type: string format: binary '400': description: The request failed validation. content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '401': description: >- Sent an `Authorization` header but the Bearer token was missing, malformed, unknown, expired, or disabled. A disabled key returns `code: "apikey_disabled"`; the other cases use the generic error envelope without a code. content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '402': description: >- A valid API key belongs to a Free workspace. Public API access requires Basic or above. The body carries `code: "plan_requires_upgrade"` and `current_plan: "free"`. content: application/json: schema: type: object properties: error: type: string code: type: string const: plan_requires_upgrade current_plan: type: string const: free requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - code - current_plan - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '403': description: >- An anonymous caller requested `hideLogo=true`. The body carries `code: "plan_requires_upgrade"`, `current_plan: "anonymous"`, and `required_capability: "removeWatermark"`. content: application/json: schema: type: object properties: error: type: string code: type: string const: plan_requires_upgrade description: >- Always the literal string `plan_requires_upgrade`. Clients can switch on this value to surface an upgrade CTA. current_plan: type: string const: anonymous description: The caller is anonymous. required_capability: type: string const: removeWatermark description: The capability required to hide the Lora logo. requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - code - current_plan - required_capability - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '429': description: >- Rate limit exceeded. Anonymous callers share a per-IP budget (60 requests/minute, sliding window). Authenticated callers are bucketed by the workspace's per-key cap (600/minute on Basic, 1500/minute on Business and Enterprise). Requests that present an `Authorization` header are additionally subject to a per-IP cap on failed verification attempts (60/minute, sliding window): once an IP exhausts that budget, further requests with an unverified Bearer token receive this 429 before the key is checked, and valid keys never count toward it. The body uses the standard error envelope with `code: "rate_limit_exceeded"`. The `Retry-After` response header contains the number of seconds (≥ 1, ≤ window) the client should wait. The 429 response is never CDN-cached (`Cache-Control: no-store`) so a single blocked edge POP doesn't lock out every visitor behind it. headers: Retry-After: description: >- Seconds the client should wait before retrying. Always a positive integer, never larger than the rate-limit window. schema: type: integer minimum: 1 maximum: 60 Cache-Control: description: >- Always `no-store` on the 429 response so a CDN POP can't memoize the denial and lock out every visitor behind it until the cache entry expires. schema: type: string enum: - no-store X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string content: application/json: schema: type: object properties: error: type: string code: type: string const: rate_limit_exceeded description: >- Always the literal string `rate_limit_exceeded`. Clients can switch on this value to surface a back-off UX. requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - code - requestId additionalProperties: false '500': description: Internal Server Error content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string security: - {} - bearerAuth: [] components: securitySchemes: bearerAuth: type: http scheme: bearer ````