Features

Everything Current ships with today.

Create short, memorable links with custom aliases or auto-generated codes.

Optional custom_code — omit it and Current generates a short, random code automatically
Attach a title, description, and category to every link for organization
A show_on_frontpage flag controls whether a link appears in the public frontpage listing for its category

Track every click with referrer, device, browser, and geographic breakdowns.

Per-URL analytics: total clicks, unique visitors, country/device/browser breakdowns, a daily click series, top referrers, and average response time
Global analytics and top-visitor reports across all links in the instance
Configurable analytics retention (analytics_retention_days setting) with automatic pruning of old records

Every shortened URL gets an automatically generated QR code.

QR codes are generated automatically for every shortened URL — no extra setup
Fetch a PNG QR code with a single unauthenticated request to /{short_code}.qr
Suitable for print material, signage, or embedding directly in another application

Admin, Maintainer, and Viewer roles with fine-grained OAuth2-style scopes.

Three built-in roles: Admin (full access including user management), Maintainer (read/write URLs and analytics), Viewer (read-only)
Define custom roles with narrower scope sets through the Roles API
Every permission check resolves to an explicit scope (for example users:admin or urls:write), not a role-name check

Isolate URL namespaces per tenant or team without collisions.

Categories group related links — marketing campaigns, per-team namespaces, or product lines
Role-scoped access lets multiple teams share a single Current instance without their links colliding
Default and frontpage categories ship out of the box; create additional categories through the API

Stateless API authentication with rotating refresh tokens.

Short-lived access tokens (30 minutes) paired with rotating refresh tokens (7 days)
Bearer-token authentication is required on every protected endpoint
Dedicated login, refresh, and logout endpoints give full control over the session lifecycle

Enterprise single sign-on integration, gated via the PenguinTech License Server.

Enterprise SSO integration validated against license.penguintech.io
Production deployments check entitlement — or a cached offline entitlement — before enabling SSO
Contact sales for current tier details; see Licensing for how entitlement checks work

Built-in observability with a Basic-Auth-protected metrics endpoint.

A /metrics endpoint exposes Prometheus-format metrics behind Basic authentication
Health, readiness, and liveness probes require no authentication, for use by load balancers and orchestrators
The reference Docker Compose stack bundles Prometheus and Grafana, scraping the backend automatically

Per-IP request rate limiting protects the API from abuse.

A default limit of 10 requests/second per IP, configurable via RATE_LIMIT_PER_SECOND
Requests over the limit receive a standard HTTP 429 response
Adjustable per deployment through the Settings API

Run on PostgreSQL, MySQL, MariaDB Galera, or SQLite.

PostgreSQL 16 is the default primary database in the reference deployment
MySQL and MariaDB Galera (with WSREP retry logic for cluster reads/writes) are also supported
SQLite mode enables a lightweight, single-node deployment without a separate database container

Admin-only endpoints for ACME certificate requests and renewal.

Admin-scoped endpoints to view certificate info, request an ACME certificate, and trigger renewal
Complements external TLS termination options — the bundled reverse proxy or an external load balancer/ingress