v1.0 · Free to use · No sign-up required

Xe Code QR API

Generate QR codes for any content — URLs, WiFi, contacts, payments, and 80+ more types. Two API types to fit any integration: embed as an image or receive base64 JSON data.

Phishing protection built-in

CORS enabled · Free for all origins

Rate-limited · Respects fair use

Base URL

text

https://xeboki.com/xe-code/QRCode/api

No sign-up required to get started. The free tier allows up to 30 Image API and 20 JSON API requests per minute per IP. To increase limits, request a free API key.

Two API Types

Choose the integration style that fits your use case.

Image API

Returns a raw PNG or SVG image. Drop the URL directly into an <img> tag, email template, or PDF.

GET /api/qr — simple query params

PNG + SVG output

CDN-cacheable response

30 req/min free · 300 with key

JSON Data API

Returns a JSON object with base64 dataUrl + metadata. Best for server-side apps, mobile, and storage pipelines.

POST /api/qr/json — JSON body

base64 dataUrl + raw SVG string

Full metadata in response

20 req/min free · 200 with key

Feature	Image API	JSON API
HTTP method	GET	POST
Response type	image/png or image/svg+xml	application/json
Use in <img src=...>	✅ Yes	❌ No (use dataUrl)
Cacheable by CDN	✅ Yes (1h)	❌ No (no-store)
Includes metadata	❌ No	✅ Yes
Free rate limit	30 req/min	20 req/min
API key rate limit	300 req/min	200 req/min
Max size	1000 × 1000 px	1000 × 1000 px
SVG support	✅ Yes	✅ Yes (+ raw SVG string)

Authentication

The API works without authentication (free tier). An API key increases your rate limits.

No Key

Works out of the box. 30 Image / 20 JSON requests per minute per IP.

Free API Key

Request a key to unlock 300 Image / 200 JSON requests per minute.

Pro Key (Soon)

Higher limits, analytics dashboard, and priority support.

Passing your API key

Add api_key as a query parameter (Image API) or as a field in the JSON body (JSON API).

bash

# Image API — query param
curl "https://xeboki.com/xe-code/QRCode/api/qr?data=Hello&api_key=xk_YOUR_KEY"

# JSON API — body field
curl -X POST https://xeboki.com/xe-code/QRCode/api/qr/json \
  -H "Content-Type: application/json" \
  -d '{"data":"Hello","api_key":"xk_YOUR_KEY"}'

Rate Limits

Limits use a 60-second sliding window tracked per IP (no key) or per API key.

Tier	Image API	JSON API	Identifier
Free (no key)	30 / min	20 / min	Per IP address
Free API Key	300 / min	200 / min	Per API key
Pro (coming soon)	3,000 / min	2,000 / min	Per API key

Every response includes rate-limit headers:

http

X-RateLimit-Limit: 30
X-RateLimit-Remaining: 27
X-RateLimit-Reset: 1720000060
Retry-After: 43          ← only on 429 responses

GET/api/qr

Returns a raw QR code image (PNG or SVG)

Query Parameters

Param	Type	Default	Description
`data`req	`string`	—	Content to encode. Max 2048 chars. Can be a URL, text, WiFi config, vCard, etc.
`size`	`number`	200	Image width & height in pixels. Range: 50–1000.
`format`	`string`	png	Output format. 'png' returns image/png · 'svg' returns image/svg+xml.
`dark`	`hex`	000000	Foreground (module) colour. 6-digit hex, with or without #.
`light`	`hex`	ffffff	Background colour. 6-digit hex.
`margin`	`number`	2	Quiet-zone size in modules. Range: 0–10.
`ecc`	`string`	M	Error correction level: L (7%) · M (15%) · Q (25%) · H (30%).
`api_key`	`string`	—	Optional. Your API key to unlock higher rate limits.

Examples

bash

# Simple URL QR code
curl "https://xeboki.com/xe-code/QRCode/api/qr?data=https://xeboki.com" \
  -o qr.png

# Branded — custom colours, SVG output
curl "https://xeboki.com/xe-code/QRCode/api/qr?data=https://xeboki.com&format=svg&dark=16a34a&light=f0fdf4&size=400&ecc=H" \
  -o qr.svg

Response

200 OK

Content-Type: image/png (or image/svg+xml). Raw image bytes.

POST/api/qr/json

Returns QR code as base64 data URL inside a JSON envelope

Request Body

Field	Type	Default	Description
`data`req	`string`	—	Content to encode. Max 2048 chars.
`size`	`number`	300	Image width & height in pixels. Range: 50–1000.
`format`	`string`	png	'png' or 'svg'. SVG response also includes raw SVG string.
`dark`	`hex`	000000	Foreground colour. 6-digit hex.
`light`	`hex`	ffffff	Background colour. 6-digit hex.
`margin`	`number`	2	Quiet-zone size in modules. Range: 0–10.
`ecc`	`string`	M	Error correction level: L · M · Q · H.
`api_key`	`string`	—	Optional. Your API key.

Success Response

json

{
  "success": true,
  "format": "png",
  "width": 300,
  "height": 300,
  "dataUrl": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA...",
  "meta": {
    "data": "https://xeboki.com",
    "size": 300,
    "dark": "#000000",
    "light": "#ffffff",
    "ecc": "M",
    "margin": 2,
    "generatedAt": "2026-03-13T10:00:00.000Z"
  }
}

Examples

bash

curl -X POST https://xeboki.com/xe-code/QRCode/api/qr/json \
  -H "Content-Type: application/json" \
  -d '{
    "data": "https://xeboki.com",
    "size": 400,
    "format": "png",
    "ecc": "H"
  }'

Error Codes

All errors return JSON with an error field.

Status	Meaning	Fix
400	Bad Request	Missing or invalid parameters. Check the error message.
429	Too Many Requests	You hit the rate limit. Check Retry-After header or get an API key.
451	Unavailable For Legal Reasons	Content was blocked by our phishing/malware filter. See reason field.
500	Internal Server Error	Rare. Usually means the data string is malformed or uncodeable.

Error response shape

json

// 400 example
{ "error": "Missing required param: data", "docs": "https://xeboki.com/xe-code/QRCode/api-docs" }

// 429 example
{
  "error": "Rate limit exceeded.",
  "hint": "Get a free API key at xeboki.com/xe-code/QRCode/api to increase your limit.",
  "resetAt": "2026-03-13T10:01:00.000Z"
}

// 451 example
{
  "error": "Content blocked.",
  "reason": "URL shorteners are not allowed — they hide the true destination.",
  "help": "Contact support@xeboki.com if you believe this is a false positive."
}

SDKs & Integration Examples

Official SDKs are coming. In the meantime, here are ready-to-use snippets for common stacks.

⚛️

React / Next.js

Drop a QR code into any component using the Image API URL as src.

🐍

Python

Use requests for the Image API or JSON API in scripts and backends.

🟩

Node.js

Use https or axios. Works in Lambda, Vercel Functions, and Express.

📱

Flutter / Dart

Use Image.network() with the Image API URL — no package needed.

🐘

PHP

file_get_contents() or cURL for Image API. json_decode for JSON API.

📄

HTML / No-code

One <img> tag. No JavaScript or server required.

Code Examples

tsx

import Image from 'next/image';

function QRCode({ value, size = 200 }: { value: string; size?: number }) {
  const src = `https://xeboki.com/xe-code/QRCode/api/qr?${new URLSearchParams({
    data: value,
    size: String(size),
  })}`;
  return <Image src={src} alt="QR code" width={size} height={size} unoptimized />;
}

// Usage
<QRCode value="https://xeboki.com" size={300} />

Pro tier & SDK coming soon

We're building an official JavaScript/TypeScript SDK, a Python package, webhook events, analytics dashboard, and a Pro tier with higher limits, custom branding, and bulk generation.

Join the early access list

Xe Code · Part of the Xeboki suite

QR Studio Barcode Studio Support xeboki.com