The status code is a business decision
Your redirect status code looks like trivia and is actually a business decision.
A permanent redirect gets cached aggressively by browsers, so the second time somebody clicks, their browser goes straight to the destination without contacting you at all.
Read both sides of that. Great for your load. Fatal for your analytics, because you never see repeat clicks, and if your customer later edits the destination, everyone holding the cached redirect keeps landing on the old one.
Use a temporary redirect and every click comes back to you. Nearly every commercial shortener chooses per-click visibility, because the click counts are the product and the redirect is only the delivery mechanism.
Analytics off the critical path
Hang your analytics off the redirect asynchronously. On each click your server emits an event carrying the code, the timestamp, the user agent, the referrer and a coarse location, then answers the redirect without waiting.
Aggregate those into a columnar store, where clicks by country by hour over a billion events is a sub-second query. Keeping this off the redirect's critical path is the difference between an analytics outage and a product outage.
Handle expiry lazily. Check the expiry at read time, return gone, and let a nightly job reclaim the rows, rather than racing timers.
Budget for abuse, the unglamorous half of running a public shortener. Phishers love hiding behind your domain, so you need a scan at creation time, a warning page for suspicious destinations, and a kill switch per code.
Take the cautionary tale seriously. When a shortener is not the core business, the endless abuse fight makes it an easy product to shut down, and one large company did exactly that.
Worked example
Priya runs link infrastructure at an email marketing company where customers pay for click reports. A well-meaning platform engineer flips redirects from 302 to 301 during a performance push, and it works: origin traffic drops 30 percent over two weeks as browsers and corporate proxies cache the redirects. Then customer dashboards start showing click counts sliding down 25 to 40 percent with no change in email volume, and two agencies threaten to churn over broken tracking. It takes four days to connect the dashboards to the status code because the redirect service itself looks perfectly healthy. Priya reverts to 302, adds a lint rule that fails the build if the redirect handler returns 301, and writes the incident up: the company sells the click data, so browser caching is not an optimization, it is revenue loss.