Scoped API keys
Separate read and write permissions and revoke individual credentials.
LINKTIMER GUIDE
LinkTimer developer API and signed webhooks
Business workspaces can create scoped API keys and use a versioned HTTP endpoint for managed-link workflows.
What this option gives you
Versioned REST routes
Use /api/v1/links for creation, listing, updates, and deletion.
Signed lifecycle webhooks
Verify HMAC signatures on created, opened, updated, and deleted link events.
Practical use cases
CRM automation
Create a time-limited customer link when a record reaches a workflow stage.
Internal tools
List and manage workspace links from an operations dashboard.
Event processing
Receive signed link-open notifications at a controlled endpoint.
Batch systems
Use repeated API requests with idempotent application logic.
How it works
Create a workspace key
Choose required scopes and copy the secret once.
Send the Authorization header
Use Bearer authentication over HTTPS.
Verify webhook signatures
Compute HMAC SHA-256 over the exact request body.
Important limitation
API keys and webhook secrets are credentials. Store them in a secret manager, rotate them, and never expose them in browser code or public repositories.
Frequently asked questions
Where is the API endpoint?
Use https://linktimer.net/api/v1/links after the hosting rewrite is deployed.
How are API keys shown?
The full key is returned only when created; later screens show a prefix.
How are webhooks signed?
LinkTimer sends an x-linktimer-signature header using HMAC SHA-256.
Can a key be revoked?
Yes. Revocation stops future authenticated requests.
Authoritative external resources
These links provide additional context from the destination provider or recognized security resources. External sites are responsible for their own content and policies.
- Firebase HTTP functionsOfficial guidance for HTTP-triggered Cloud Functions.
- Google Safe Browsing Transparency ReportCheck whether a destination has known unsafe-content warnings before sharing it.
- OWASP phishing guidanceUnderstand common deceptive-link patterns and why LinkTimer keeps the destination hostname visible.
Related LinkTimer guides
Ready to make the destination temporary?
Choose the expiration rule, confirm the destination, and share the generated LinkTimer URL or QR code.
Open the LinkTimer creator