Shlink

A PHP link shortener with an API and CLI, but no built-in UI

Shlink serves short links from your own domain and records every visit. The PHP server is driven only through its REST API or its command line. The graphical interface is a separate app, the official web client, which you can use at app.shlink.io or host yourself.

Rule-based redirects and scoped API keys

• Redirect rules: each short link can carry a prioritized list of rules, and the first one whose conditions all match picks the destination. Conditions cover language, device, browser, IP address or CIDR block, country or city, query parameters, and dates before or after a threshold.
• Several domains, one instance: the same slug can exist on several domains, each link keeping its own tags and visits.
• Scoped API keys: a key can be limited to the links it created, to a single domain, or kept away from orphan visits. Roles are set on the command line when the key is generated and can't be edited afterwards.
• Visits without raw IPs: IP addresses are stored anonymized by default, likely bots are flagged from the User-Agent, and hits on unknown URLs (404s, the bare domain) are counted separately. Appending /track to a short link returns a transparent pixel that records email opens.
• Expiring links: each link can have a start date, an end date and a visit cap. The short-url:delete-expired command removes expired links, and scheduling it is up to you.
• Migrations: imports from Bitly, YOURLS, Kutt, a CSV file or another Shlink instance, with visits included from YOURLS, Kutt and Shlink. YOURLS needs a plugin installed on its side first.

UI shipped separately, SQLite for testing only, 5.1.8 current

The server has no user accounts. Shlink only knows API keys, and its architecture page leaves end-user permissions to a client app with its own back end. For logins and roles, the team publishes Shlink Dashboard, at version 0.3.3 since October 24, 2026: a Node.js 22+ app with no hosted version and its own database (MySQL, MariaDB, PostgreSQL or SQL Server).

Shlink is designed around containers. The same page calls it an API-first service built for cloud-native environments, walks people coming from Bit.ly or YOURLS through those choices, and says shared hosting has never been the focus of the project. RoadRunner, the recommended runtime, is the one inside the Docker image and the only one that publishes real-time events to Mercure, RabbitMQ or Redis. Outside Docker, Shlink needs PHP 8.4 or 8.5.

SQLite is for trying it out. The docs say it is not officially supported in production, which leaves MySQL, MariaDB, PostgreSQL or SQL Server, and the ARM Docker image ships without SQL Server drivers. Geolocating visits, and with it any country or city rule, requires a GeoLite2 license key, which is free but tied to a MaxMind account.

Matomo gets the raw IP address. With the Matomo integration turned on, every visit is sent there with the full IP, and anonymizing it becomes a Matomo setting.

Version 5.1.8 came out on October 21, 2026. It is the twelfth release of the 5.x line, which opened on January 9, 2026, and it moves the Docker images to Alpine 3.24 so they receive PHP security fixes again. Version 5.0 took QR code generation out of the server (the web client and Shlink Dashboard handle it now), dropped PHP 8.3 and stopped detecting trusted proxies on its own: with more than one proxy in front of Shlink, TRUSTED_PROXIES has to be set.