Docs

Build on Linksie.

API keys and webhooks are a Pro benefit — create them in Settings → Developers. Send your key as Authorization: Bearer <key>. Keys without Pro get HTTP 402.

API reference

GET/api/v1/public/statsread

Arrivals, taps, 18+ passes and click-through for a range, this window against the last, plus top links and daily series.

GET/api/v1/public/pagesread

Your page with every link including the real destinations.

GET/api/v1/public/subscribersread

Collected emails, newest first, cursor-paginated (?cursor, ?limit up to 100).

POST/api/v1/public/scanread

All ten scanner checks on any link page { url }. The public widget shows three.

POST/api/v1/public/linkslinks:create

Create a link { title, destinationUrl, … }. Appended at the end; reorder it on your page in the editor.

PATCH/api/v1/public/links/{id}links:hide

Toggle visibility only { isVisible }. Anything else is rejected: a scoped key can never rewrite destinations.

Webhooks

Signed POSTs with X-Linksie-Event and X-Linksie-Signature: sha256=<hmac of the raw body with your endpoint secret>. Retried 5 times with backoff; endpoint health shows in Settings.

link.clicked

A human taps a link or social button (bots excluded). Payload: linkId, title, kind, destinationHost, source.

subscriber.created

Someone joins the email box. Payload: email, source, campaign.

scan.dropped

The nightly watch finds your score down 10+ or a newly-failing check. Payload: url, prevScore, score, newFailures.

page.published

A new version goes live. Payload: pageId, domain, versionId.

Scanner methodology

The scanner grades the static HTML a platform crawler sees — no JavaScript, the same view as their fetcher. Verify the two load-bearing claims yourself against any live Linksie page:

curl -A "facebookexternalhit/1.1" https://your-page.com/ > bot.html
curl -A "Mozilla/5.0 (iPhone)" https://your-page.com/ > human.html
diff bot.html human.html   # identical: no cloaking
grep -Eo 'https?://[^" ']+' bot.html   # no outbound destinations

Destinations stay hidden

No raw outbound addresses in the markup: what a scraper resolves in one fetch.

No name-dropping

No platform names in visible words pairing creator with platform.

No preview card

No og:title / og:image, so pasting the link unfurls nothing worth reading.

Hidden from search

Robots meta plus X-Robots-Tag refuse indexing.

No silent trackers

No Meta, Google, TikTok, Snap or analytics pixels reporting visitors.

Secure connection

HTTPS in transit.

No detours

No redirect hops logging the visit.

Its own address

Not on a shared link-in-bio host where one report stains everyone.

Loads for fans

HTTP 2xx or 3xx. A dead page protects nothing.

Same for everyone

Fetched twice (visitor + Meta crawler UA): destinations must match. Cloaking fails hard.

Every published page is rescanned nightly and owners are emailed on any drop of 10+ points or any newly failing check. History lives in Shield.