Your campaign workflow, connected.

1. Create a scoped token

Open Settings → API & automations. Choose a private workspace, permissions, and expiry (1–365 days). Copy the token once into your application’s secret store. Never include it in browser code, URLs, shared reports, or logs. Revocation takes effect for subsequent requests; requests already in progress may finish.

2. Read campaign data

Send Authorization: Bearer YOUR_TOKEN to https://linkforge.ing/api/v1/. Responses use {"data": [...], "next_cursor": null}. Lists return up to 100 records ordered by ID; pass a non-null cursor as ?after=CURSOR until it is null.

• GET campaigns — scope campaigns:read
• GET links — scope links:read; includes destination, saved status and lifetime recorded clicks.
• GET reports — scope reports:read; returns report metadata, never public access tokens or token hashes.

Only resources in the token’s workspace are returned. Moving a campaign changes workspace-scoped API access. Links, reports and goals follow the campaign. Billing, branded domains and provider accounts remain account-wide.

Limits: 60 requests/minute/token and 120 requests/minute/source IP. HTTP 401 means invalid, revoked or expired token; 403 means missing scope or unavailable account/plan; 429 includes Retry-After. Retry a 503 later. Treat 400 as an actionable validation error.

3. Create campaigns safely

POST /api/v1/campaigns requires campaigns:write, JSON Content-Type, and an Idempotency-Key header of 8–128 characters. Reuse the same key and exact body after a timeout. A changed body with the same key returns 409. Idempotency is retained for the token’s lifetime. This endpoint creates new campaigns only; it does not edit existing campaigns or grant extra plan capacity. Maximum request body: 64 KiB.

{
  "groups": [
    {
      "name": "Autumn launch",
      "campaign_key": "autumn-launch",
      "links": [
        {
          "slug": "autumn-email",
          "channel_name": "Email",
          "destination_url": "https://example.com/autumn",
          "utm_source": "newsletter",
          "utm_medium": "email"
        }
      ]
    }
  ]
}

The normal batch limit of 100 links and your account quotas apply. Validate returned links before publication. A successful retry returns the original result without creating another campaign.

4. Receive signed events

Register a public HTTPS URL and workspace in Settings. Save the signing secret when it is shown; it is encrypted on the server and cannot be retrieved later. To replace a secret, disable the old endpoint and create a new one. Up to 10 endpoint registrations per account.

• campaign.changed: campaign created, renamed, re-keyed, moved, or its saved status changed. Payload includes campaign ID, workspace ID and status.
• click.recorded: a click event was inserted into LinkForge analytics. Payload includes link ID, campaign ID and workspace ID. Bots/previews may be included; no visitor IP, email or referrer is sent.

Each JSON payload contains id, type, occurred_at, and data. Deduplicate by event ID and accept out-of-order delivery. Do not infer that a destination loaded or a sale occurred.

Verify X-LinkForge-Signature: v1=HEX using HMAC-SHA256 with your signing secret over TIMESTAMP + "." + RAW_REQUEST_BODY. TIMESTAMP is the exact X-LinkForge-Timestamp header (Unix seconds). Use a constant-time comparison and reject timestamps more than five minutes from your clock. Each retry has a fresh delivery timestamp; event ID and body stay stable.

Checks run about every minute, processing up to 25 delivery attempts per invocation. Backlog can delay delivery. Five automatic attempts use increasing delays, then the delivery fails; up to three manual retries are available. Redirects are not followed. DNS must resolve to public IPv4 addresses; private addresses and custom ports are rejected. An HTTP 2xx means accepted by the receiver, not workflow completion.

Each endpoint holds up to 5,000 pending/sending events; excess events are skipped and counted visibly. Completed/failed history lasts 30 days. Disabled endpoints stop future attempts; already in-flight requests may complete. Unsent events do not deliver during a Premium lapse. No historical backfill or exactly-once delivery guarantee is implied.

5. Use Zapier or Make

This is generic HTTP/webhook compatibility, not a published LinkForge marketplace app. Your automation provider may require a paid plan; LinkForge does not subscribe you or change provider settings.

1. For polling, create a scheduled HTTP GET action with the endpoint and Bearer header above. Follow pagination and deduplicate returned resource IDs.
2. For event triggers, use Zapier’s Catch Raw Hook (to preserve body and headers) or Make’s Custom Webhook with raw-body/header access. Register the generated URL in LinkForge.
3. Verify HMAC and freshness in a code/verification step before performing actions. If raw body bytes are unavailable, place a verifying gateway in front of the automation.
4. For campaign creation, use an HTTP POST action. Use a stable source-event ID as the Idempotency-Key so tool retries cannot duplicate the campaign.
5. Inspect both LinkForge delivery history and the provider run history. Endpoint acceptance is not evidence of completed automation.

Zapier webhook guide · Make webhook guide · Make HTTP guide