SecureURLs.me API

Build links
with control.

SecureURLs.me's API lets you create controlled, branded and trackable links programmatically. Authenticate your requests with an API key and create links directly from your application or from this documentation.

Base URL
Replace the URL below with your SecureURLs.me API host. The endpoint shown in this documentation is /link/create.

Authentication

SecureURLs.me accepts an API key through the X-API-Key HTTP header when creating links through the API.

API Key

X-API-Key

Your API key

Your API key is used only by the browser to make the request when you click Send Request. It is not stored by this page.

Create a URL

Create or retrieve a SecureURLs.me link using the POST endpoint.

POST /link/create

Creates a new URL with optional grouping, expiration, usage policies, access policies, notes, tags, link delivery mode and custom domain.

Try it

Enter your API key, modify the JSON payload and execute the request directly from your browser.

POST /link/create

Ready

Request Body

{
  "url": "https://example.com/products/item1",
  "customPath": "invoice/diwali-sale",
  "linkMode": "REDIRECT",
  "addShortCode": true,
  "usagePolicies": {
    "type": "UNLIMITED"
  },
  "accessPolicies": {
    "mode": "PUBLIC"
  },
  "notes": "Diwali campaign landing page",
  "tags": [
    "marketing",
    "diwali",
    "campaign"
  ]
}

Response

{
  "status": "Ready",
  "message": "Execute the request to see the API response."
}

Request parameters

Parameters available for creating a SecureURLs.me link via POST /link/create.

Name	Type	Description
url required	string	The original destination URL to shorten. Must include a valid `http://` or `https://` scheme.
customPath optional	string	Optional custom path or slug (e.g. `invoice/diwali-sale` or `vip-event`). Accepted aliases: `slug`, `path`.
domain optional	string	Custom branded domain (e.g. `links.mybrand.com`). Must be configured and verified under your account. Accepted aliases: `customDomain`, `custom_domain`.
linkMode enum	string	Delivery mode for the link: `REDIRECT` (default), `IFRAME`, `PROXY`, or `MIRROR`.
addShortCode optional	boolean	When `true`, SecureURLs generates a unique short code and appends it to `customPath` (e.g. `invoice/5PQGVZoWpR8`). Default is `false`. Accepted aliases: `AddShortCode`, `add_short_code`.
usagePolicies optional	object	Controls lifetime, click limits, and scheduled access windows. See Usage Policies.
accessPolicies optional	object	Controls access authentication, IP allowlists, country/device restrictions, email OTP, and geofencing. See Access Policies.
notes optional	string	Optional internal note or campaign description. Accepted alias: `note`.
tags optional	string[]	Array of tags for categorization, filtering, and reporting (e.g. `["marketing", "campaign"]`).
expireAt legacy	ISO-8601	Legacy expiration timestamp in UTC (e.g. `2026-12-31T23:59:59Z`). Prefer `usagePolicies.expireAt`. Accepted aliases: `expire`, `expiresAt`, `expire_at`.
usageLimit legacy	object \| number	Legacy usage limit: `"once"`, `"unlimited"`, or a positive integer. Prefer `usagePolicies.usageLimit`. Accepted aliases: `limit`, `usage_limit`.

Usage Policies

The usagePolicies object controls link lifetime, maximum click thresholds, and scheduled access windows.

Field	Type	Description
type enum	string	Policy type: `UNLIMITED` (default, no click limit), `ONE_TIME` (expires after 1 click), or `USAGE_LIMIT` (expires after `usageLimit` clicks).
usageLimit optional	integer	Maximum number of allowed accesses (minimum `1`). Required when `type` is `USAGE_LIMIT`.
expireAt optional	ISO-8601	UTC timestamp after which the link becomes inactive (e.g. `2026-12-31T23:59:59Z`).
schedule optional	object	Time window during which the link is accessible. Requires both `startAt` and `endAt` in UTC ISO-8601 format, where `endAt > startAt`.

{
  "usagePolicies": {
    "type": "USAGE_LIMIT",
    "usageLimit": 500,
    "expireAt": "2026-12-31T23:59:59Z",
    "schedule": {
      "startAt": "2026-10-01T09:00:00Z",
      "endAt": "2026-10-31T18:00:00Z"
    }
  }
}

Access Policies

The accessPolicies object enforces authentication, network restrictions, device/country filtering, email OTP verification, and geofencing.

Field	Type	Description
mode enum	string	Access mode: `PUBLIC` (default, open to all visitors) or `SECURED` (enforces configured access restrictions). When set to `SECURED`, at least one restriction rule must be provided.
pin optional	object	Numeric PIN protection: `{ "pin": "482931" }`. Must contain between 4 and 12 numeric digits.
password optional	object	Password protection: `{ "password": "SecretPassword123" }`. Must contain between 6 and 128 characters.
ipAllowlist optional	object	IP address allowlist: `{ "addresses": ["103.21.45.10", "103.21.45.0/24"] }`. Supports IPv4, IPv6, and CIDR blocks.
country optional	object	Country restriction: `{ "countries": ["IN", "US", "GB"] }`. ISO 3166-1 alpha-2 uppercase country codes.
device optional	object	Device category restriction: `{ "devices": ["MOBILE", "DESKTOP", "TABLET"] }`.
referrer optional	object	HTTP Referer restriction: `{ "referrers": ["example.com", "*.partner.org"] }`.
otp optional	object	Email OTP verification: `{ "enabled": true, "emails": ["user@example.com"], "sendIndividualEmail": true }`. Only designated email recipients can receive verification codes to unlock the link.
geofence optional	object	Geographic boundary perimeter control (Circle or Polygon). See Geofencing.

Geofencing

The geofence object within accessPolicies restricts link access to physical real-world boundaries. SecureURLs supports both radial Circle boundaries and arbitrary multi-point Polygon boundaries.

How Geofencing Works
When a visitor opens a geofenced link, SecureURLs evaluates their latitude and longitude coordinates. If browser coordinates have not yet been granted, a verification challenge screen is displayed requesting location permission. Once validated, SecureURLs issues an encrypted, HTTP-only session verification cookie so subsequent clicks during the session are seamless without re-prompting.

Top-level Geofence Fields

Field	Type	Description
type required	string	Perimeter geometry type: `"CIRCLE"` or `"POLYGON"`.
action enum	string	Evaluation action when the visitor is inside the perimeter: `"ALLOW"` (default) — Access is permitted only inside the perimeter. Visitors outside are blocked. `"BLOCK"` — Visitors inside the perimeter are blocked. Visitors outside are permitted.
name optional	string	Optional descriptive label for the perimeter (e.g. `"San Francisco Tech Campus"` or `"Downtown Retail Zone"`).
circle conditional	object	Circular perimeter parameters. Required when `type` is `"CIRCLE"`.
polygon conditional	object	Polygon perimeter parameters. Required when `type` is `"POLYGON"`.

1. Circular Geofence (`circle`)

A circular geofence establishes a radial boundary around a central geographic coordinate. Evaluation uses the great-circle Haversine formula against the specified radius.

Field	Type	Description
circle.latitude required	number	Center point latitude in decimal degrees (between `-90.0` and `90.0`). Example: `37.774929`.
circle.longitude required	number	Center point longitude in decimal degrees (between `-180.0` and `180.0`). Example: `-122.419416`.
circle.radiusMeters required	integer	Radius of the perimeter in meters (must be greater than `0`). Example: `500` for a 500-meter radius around the center.

{
  "accessPolicies": {
    "mode": "SECURED",
    "geofence": {
      "type": "CIRCLE",
      "action": "ALLOW",
      "name": "Headquarters 500m Perimeter",
      "circle": {
        "latitude": 37.774929,
        "longitude": -122.419416,
        "radiusMeters": 500
      }
    }
  }
}

2. Polygon Geofence (`polygon`)

A polygon geofence defines an arbitrary, multi-sided closed geographic boundary using a sequence of vertex coordinates. Evaluation uses the ray-casting point-in-polygon algorithm.

Field	Type	Description
polygon.coordinates required	object[]	Array of coordinate points defining the vertices of the enclosed boundary. Must contain at least 3 points. Vertices should be arranged in consecutive order around the perimeter (clockwise or counter-clockwise).
coordinates[].latitude required	number	Vertex latitude in decimal degrees. Example: `37.7950`.
coordinates[].longitude required	number	Vertex longitude in decimal degrees. Example: `-122.4030`.

{
  "accessPolicies": {
    "mode": "SECURED",
    "geofence": {
      "type": "POLYGON",
      "action": "ALLOW",
      "name": "Downtown Innovation District",
      "polygon": {
        "coordinates": [
          { "latitude": 37.7950, "longitude": -122.4030 },
          { "latitude": 37.7960, "longitude": -122.3950 },
          { "latitude": 37.7900, "longitude": -122.3920 },
          { "latitude": 37.7880, "longitude": -122.4000 }
        ]
      }
    }
  }
}

Link modes

The linkMode determines how SecureURLs.me delivers the destination.

Mode	Behavior
REDIRECT	Issues an HTTP 302 redirect navigating the visitor directly to the target URL. Default mode.
IFRAME	Embeds the destination inside a SecureURLs presentation wrapper.
PROXY	SecureURLs fetches the target resource on the server and streams it back to the client, masking origin headers.
MIRROR	SecureURLs serves a rewritten copy of the destination, dynamically converting links and assets.

Response

A successful request returns the newly created link together with its full configuration.

200 URL created successfully

{
  "success": true,
  "data": {
    "newUrl": "https://secure.indexrender.io/invoice/diwali-sale",
    "originalUrl": "https://example.com/products/item1",
    "customPath": "invoice/diwali-sale",
    "existing": false,
    "expireAt": null,
    "usageLimit": null,
    "notes": "Diwali campaign landing page",
    "tags": [
      "marketing",
      "diwali",
      "campaign"
    ],
    "linkMode": "REDIRECT",
    "isActive": true,
    "publicId": "f8K2mP9xQ7La3VnR6Tc1Zw",
    "usagePolicies": {
      "type": "UNLIMITED",
      "usageLimit": null,
      "expireAt": null,
      "schedule": null
    },
    "accessPolicies": {
      "mode": "PUBLIC",
      "pin": null,
      "password": null,
      "ipAllowlist": null,
      "country": null,
      "device": null,
      "referrer": null,
      "otp": null,
      "geofence": null
    },
    "createdBy": "API"
  },
  "message": "New URL created successfully"
}

Examples & cURL

Ready-to-use cURL commands for standard creation, password & PIN protection, circular geofencing, and polygonal geofencing.

1. Standard Branded Link

curl -X POST "https://secure.indexrender.io/link/create" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{
    "url": "https://example.com/products/item1",
    "customPath": "invoice/diwali-sale",
    "linkMode": "REDIRECT",
    "addShortCode": true,
    "usagePolicies": {
      "type": "UNLIMITED"
    },
    "accessPolicies": {
      "mode": "PUBLIC"
    },
    "notes": "Diwali campaign landing page",
    "tags": [
      "marketing",
      "diwali"
    ]
  }'

2. Link with Circular Geofence (500m Radius)

curl -X POST "https://secure.indexrender.io/link/create" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{
    "url": "https://example.com/confidential-briefing",
    "customPath": "briefing-sf",
    "linkMode": "REDIRECT",
    "accessPolicies": {
      "mode": "SECURED",
      "geofence": {
        "type": "CIRCLE",
        "action": "ALLOW",
        "name": "SF Office 500m Perimeter",
        "circle": {
          "latitude": 37.774929,
          "longitude": -122.419416,
          "radiusMeters": 500
        }
      }
    },
    "notes": "Location-restricted access to internal document"
  }'

3. Link with Polygon Geofence (Custom Boundary)

curl -X POST "https://secure.indexrender.io/link/create" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{
    "url": "https://example.com/expo-exclusive",
    "customPath": "expo-zone",
    "linkMode": "REDIRECT",
    "accessPolicies": {
      "mode": "SECURED",
      "geofence": {
        "type": "POLYGON",
        "action": "ALLOW",
        "name": "Convention Center District",
        "polygon": {
          "coordinates": [
            { "latitude": 37.7950, "longitude": -122.4030 },
            { "latitude": 37.7960, "longitude": -122.3950 },
            { "latitude": 37.7900, "longitude": -122.3920 },
            { "latitude": 37.7880, "longitude": -122.4000 }
          ]
        }
      }
    },
    "notes": "Attendee-only access inside convention grounds"
  }'

4. Multi-Layer Security (Password + PIN + Email OTP)

curl -X POST "https://secure.indexrender.io/link/create" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{
    "url": "https://example.com/board-minutes-q3",
    "customPath": "board-q3",
    "linkMode": "REDIRECT",
    "usagePolicies": {
      "type": "USAGE_LIMIT",
      "usageLimit": 20,
      "expireAt": "2026-12-31T23:59:59Z"
    },
    "accessPolicies": {
      "mode": "SECURED",
      "password": {
        "password": "BoardMeetingPassword2026!"
      },
      "pin": {
        "pin": "918273"
      },
      "otp": {
        "enabled": true,
        "emails": ["director1@example.com", "director2@example.com"],
        "sendIndividualEmail": true
      }
    },
    "notes": "Confidential Q3 board minutes with 3-tier verification"
  }'

Build links with control.

Authentication

Create a URL

Try it

Request parameters

Usage Policies

Access Policies

Geofencing

Top-level Geofence Fields

1. Circular Geofence (circle)

2. Polygon Geofence (polygon)

Link modes

Response

Examples & cURL

1. Standard Branded Link

2. Link with Circular Geofence (500m Radius)

3. Link with Polygon Geofence (Custom Boundary)

4. Multi-Layer Security (Password + PIN + Email OTP)

Build links
with control.

1. Circular Geofence (`circle`)

2. Polygon Geofence (`polygon`)