remove API key requirement from POST /api/shorten

static/app.js

@@ -218,6 +218,7 @@ async function lookupUrl(url) {
 }
 
 async function handleEnter() {
+  clearTimeout(_lookupTimer);          // cancel any pending debounced lookup
   const input = document.getElementById('url-input');
   const url = input.value.trim();
   if (!url || !isValidUrl(url)) {
@@ -225,17 +226,27 @@ async function handleEnter() {
     setStatus('', '');
     return;
   }
-  if (!state.apiKey) {
-    // No API key — just do a lookup
-    await lookupUrl(url);
-    return;
-  }
+
+  // First, check if this URL already exists
+  setStatus('checking…', '');
+  try {
+    const lookupRes = await apiGet('/api/lookup?url=' + encodeURIComponent(url));
+    if (lookupRes.ok) {
+      // URL already exists — just show its metadata
+      const data = await lookupRes.json();
+      state.currentMeta = data;
+      renderMeta(data);
+      setStatus('exists', 'ok');
+      return;
+    }
+  } catch { /* lookup failed, proceed to create */ }
+
+  // URL does not exist — attempt to create
   setStatus('creating…', '');
   try {
-    const res = await apiPost('/api/shorten', { api_key: state.apiKey, url: url });
+    const res = await apiPost('/api/shorten', { url: url });
     if (res.status === 201) {
       const shortUrl = await res.text();
-      // Fetch metadata for the newly created URL
       const code = shortUrl.split('/').pop();
       const metaRes = await apiGet('/api/urls/' + encodeURIComponent(code));
       if (metaRes.ok) {
@@ -243,11 +254,8 @@ async function handleEnter() {
         state.currentMeta = data;
         renderMeta(data);
         setStatus('created ✓', 'ok');
-        // Refresh admin list
         if (state.isAdmin) fetchAdminUrls();
       }
-    } else if (res.status === 403) {
-      setStatus('invalid key', 'err');
     } else {
       const err = await res.json().catch(() => null);
       setStatus(err?.error || 'error', 'err');