QR code API docs

The base URL is https://qr.cuelark.com. GET or POST /v1/qr returns the image itself, and POST /v1/decode reads a code. No account or key is needed.

GET or POST /v1/qr

Parameter	Meaning
data	Text or link to encode (up to 2,000 characters). Use this or type + fields.
type	url, text, wifi, vcard, email, sms, phone, whatsapp, event, location or upi
fields	POST: object with the type's fields. GET: pass the fields as query parameters, e.g. type=wifi&ssid=Guest&password=...
format	png (default) or svg
size	64 to 2048 pixels (default 512)
fg / bg	Hex colors without # in a URL (fg=1e3a8a), or bg=transparent
margin	Quiet zone in modules, 0 to 10 (default 4)
ecc	Error correction L, M (default), Q or H
style	square (default), rounded or dots

Fields per type

type	fields
wifi	ssid, password, encryption (WPA, WEP, nopass), hidden
vcard	firstName, lastName, org, title, phone, workPhone, email, website, street, city, region, zip, country, note
email	to, subject, body
sms	phone, message
phone	phone
whatsapp	phone (with country code), message
event	title, start, end (YYYY-MM-DDTHH:MM), location, description, allDay
location	lat, lng, label
upi	vpa, name, amount, note

html

<img src="https://qr.cuelark.com/v1/qr?data=https%3A%2F%2Fexample.com&size=256" width="256" height="256" alt="QR code for example.com">

const svg = await fetch("https://qr.cuelark.com/v1/qr", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ type: "vcard", fields: { firstName: "Jane", lastName: "Rivera", phone: "+14155550134" }, format: "svg" }),
}).then((r) => r.text());

POST /v1/decode

Send a PNG or JPEG as the raw body (content-type image/png or image/jpeg), or JSON with image (base64) or url (a public image link). Images up to 4 MB and 16 megapixels.

bash

curl -X POST https://qr.cuelark.com/v1/decode -H "content-type: application/json" \
  -d '{"url":"https://qr.cuelark.com/v1/qr?data=hello"}'
# {"found":true,"text":"hello","version":1,"type":"unknown","summary":"Plain text"}

Limits

240 requests per minute per IP. Repeated GET image URLs are served from Cloudflare's cache.
Decoding: 200 images per day per IP.
Free API keys with higher limits are coming with Cuelark accounts; keys will be sent as Authorization: Bearer <key>.

Errors

Errors are JSON: {"error":"bad_request","message":"…"}, with status 400 (bad input or URL refused), 413 (too large), 429 (limit reached; see retry-after) or 504 (image URL timed out).

Security and privacy

Image URLs must be public http(s) on ports 80 or 443 and resolve to public IP addresses, checked again on every redirect. localhost, private ranges and cloud metadata addresses are refused.
Inputs and outputs aren't stored or logged. Counters for the free limits use salted hashes, never raw IP addresses.

Using an AI assistant? See the MCP server.