Developer Terms of Service

Effective date: July 10, 2026

These Developer Terms of Service ("Developer Terms") govern access to and use of the LeonAI Links REST API at api.short.leonai.io ("API"), the official SDKs (TypeScript, Python, Go), webhooks, OAuth applications, and the LeonAI apps for Make.com and Zapier (collectively, the "Developer Platform"), operated by LeonAI LTD ("LeonAI," "we," "us"). They supplement the Terms of Service, the Acceptable Use Policy ("AUP"), the Privacy Policy, and the Data Processing Agreement ("DPA"). For API-specific matters, these Developer Terms prevail; for everything else, the Terms of Service control. By requesting an API key or calling the API, you accept these Developer Terms.

1. API Keys and Credentials

1. API keys are issued per user or team through the dashboard and carry scoped permissions: links:read, links:write, and analytics:read. Request only the scopes you need.
2. Keys are shown in plaintext once, at creation; LeonAI stores only a hash and cannot recover a lost key.
3. You must keep keys confidential. Never embed API keys in client-side code, mobile app binaries, or public repositories. Route client applications through your own backend.
4. Rotate keys periodically and immediately upon suspected compromise. You are responsible for all API activity performed with your keys, whether or not authorized by you.
5. LeonAI may revoke or reset keys that are exposed publicly, used abusively, or associated with a security incident, with notice where practicable.

2. OAuth Applications

If you build an OAuth application on the Developer Platform (including via Make.com or Zapier):

1. Your consent screen and app listing must accurately identify your application and the scopes requested; misleading names, impersonation of LeonAI, or scope creep are prohibited.
2. Access and refresh tokens must be stored encrypted and never logged; refresh tokens must be rotated per our documentation.
3. You must provide end users of your application a privacy notice describing your use of data obtained from LeonAI.
4. LeonAI may suspend OAuth applications that present security or deception risks.

3. Rate Limits

API requests are limited per subscription tier:

Per-endpoint burst limits also apply as documented. When a limit is exceeded, the API returns 429 Too Many Requests with a Retry-After header; current usage is exposed via X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers. You must honor these signals with backoff. Circumventing rate limits — including by rotating API keys, accounts, or IP addresses — is prohibited. Requests beyond quota are rejected, not billed; metered overage is available only by separate Enterprise agreement.

4. Acceptable API Use

In addition to the AUP, which applies to every link created through the API, you must not:

1. Operate a competing general-purpose URL shortening service that resells access to the shared short-link domain. Building shortening features into your own product for your own users is welcome; wholesale resale of our shared domain is not. Enterprise white-label terms are available for reseller models.
2. Bulk-enumerate short codes, scrape link or analytics data you do not own, or systematically resolve links for data harvesting.
3. Artificially inflate click or scan counts, or generate synthetic traffic against redirects.
4. Exceed documented limits by parallel-account schemes, or interfere with the operation of the API.
5. Misrepresent your application's identity in User-Agent strings or OAuth metadata.

The bulk endpoint (POST /api/v1/links/bulk) accepts at most 1,000 links per request; each link in a bulk request is individually subject to the AUP and link scanning.

5. End-User Data Obtained via the API

Analytics data returned by the API (click events, geolocation, device, browser, referrer, UTM data) relates to the End Users of your links. When you retrieve it:

1. You (or your customer) are the data controller for that data; LeonAI processes it as your processor under the DPA.
2. You must have a lawful basis for your processing and provide any legally required notices to End Users.
3. You must honor deletion: when data is deleted in LeonAI, you must delete corresponding cached copies within 30 days; when an End User validly requests erasure from you, you must also delete your copies exported from LeonAI.
4. You must not attempt to re-identify truncated IP addresses or coarse geolocation, combine analytics with other data to identify individual End Users, or sell End-User data.
5. Special-category (sensitive) data must not be encoded in URLs, UTM parameters, or link metadata passed to the API.

6. Webhooks

1. Webhook endpoints must use HTTPS with a valid certificate.
2. Every delivery is signed with HMAC SHA-256 in the X-Webhook-Signature header using your webhook secret; you must verify the signature before trusting a payload.
3. Deliveries are retried up to 5 times with exponential backoff (approximately 1s, 5s, 30s, 5m, 1h). Your endpoint should respond 2xx within 10 seconds and be idempotent, keyed on the delivery ID.
4. Endpoints failing more than 90% of deliveries over 7 days may be automatically disabled with notice; delivery logs are available in the dashboard.
5. Webhook payloads may contain End-User analytics data, to which Section 5 applies.

7. API Versioning and Deprecation

1. The API is versioned in the URL (/api/v1, /api/v2). Within a version, we make only backward-compatible changes (adding fields, endpoints, or enum values); your integration must tolerate unknown fields.
2. When a new major version ships, the previous version remains supported for a minimum of 12 months.
3. Deprecations are announced by email to affected key owners and signaled in responses via Deprecation and Sunset headers at least 12 months before removal.
4. Endpoints or fields marked beta may change or be withdrawn without notice and carry no support or SLA commitment.

8. SDKs and Licenses

The official SDKs are open source under the MIT License, provided "as is" without warranty, as stated in their license files. These Developer Terms govern your use of the API through the SDKs; the MIT License governs the SDK code itself.

9. Branding and Attribution

You may state factually that your application is "Powered by LeonAI" or "integrates with LeonAI Links." You must not imply sponsorship, partnership, or endorsement by LeonAI, use our logos except with our prior written permission (written brand guidelines are in preparation; until they are published, request permission at care@leonai.io), or register names or domains confusingly similar to "LeonAI." Apps published to Make.com or Zapier are additionally subject to those platforms' terms and review processes.

10. Monitoring, Suspension, and Termination

1. LeonAI monitors API traffic for abuse, security threats, and unusual load. We may throttle or suspend API keys, OAuth applications, or webhook endpoints where reasonably necessary, with notice where practicable — and immediately, without notice, where the activity causes active harm (e.g., phishing-link creation at scale, credential-stuffing, scanner-bypass attempts).
2. On termination of your account or of API access: keys are revoked, webhooks stop, and you must delete data cached from the API within 30 days, except analytics data you independently exported and lawfully retain as its controller (to which Section 5 continues to apply).
3. Sections 5, 8, 9, 10.2, and 11 survive termination.

11. Support, Availability, Disclaimers

API availability commitments and service credits exist only for Enterprise customers under the SLA. For all other tiers, the API is provided without uptime warranty. The disclaimers of warranties, limitations of liability, and indemnification provisions of the Terms of Service apply fully to the Developer Platform. Support is available at care@leonai.io; Enterprise support response times are in the SLA.

12. Changes to the API and to These Terms

We will give at least 30 days' notice of material changes to these Developer Terms by email and dashboard notice; continued use after the effective date constitutes acceptance. Non-breaking API additions may ship at any time. Fees: API access is included in each subscription tier; we will not introduce separate API fees for existing tiers without the notice described in the Terms of Service.

13. Governing Law and Contact

These Developer Terms are governed by the law and dispute-resolution provisions of the Terms of Service (the laws of the State of Israel; competent courts of Tel Aviv-Yafo). Questions: care@leonai.io, or write to LeonAI LTD, Avraham Pachornik 17, Ness Ziona, Israel.