🔒Secure Links APIpuny.io

Secure links and self-destructing capsules

Puny creates secure links with passwords, allowlisting, and auto-expiry — plus one-time capsules that store sensitive information and self-destruct after a single use.

Get API keys →View SDKs on GitHub

create-capsule.sh

# Create a self-destructing capsule
curl https://api.puny.io/v1/capsules \
  -H "Authorization: Bearer $PAYING_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "content": "db-prod-password: hunter2",
    "one_time": true,
    "password": "shared-secret",
    "expires_in": "24h"
  }'

# → { id, url, expires_at, one_time: true }

What you can build

Control who sees what, and for how long

Secure links and one-time capsules with the access controls built in. Set them per request.

Password-protected

Require a password before a link resolves, so only holders of the secret can open it.

Allowlisting

Restrict access to specific email addresses or domains — everyone else is blocked.

Auto-expiry

Set links to expire after a time window or a maximum number of opens.

One-time capsules

Store sensitive data in a capsule that reveals once and self-destructs after a single view.

Short, branded links

Generate compact secure links you can share anywhere, with your own domain.

Access logs

See when a link or capsule was opened so you can audit access programmatically.

Quick start

Create a one-time capsule

Authenticate with a bearer token, post your secret with access rules, and Puny returns a short URL that self-destructs after one view.

Grab your keys

Install the SDK

Pull puny-sdks for your language from the PayingCo GitHub org.

Create a capsule

Post your secret with expiry and access rules — share the short URL that comes back.

Official SDKs

Maintained libraries with auth, link, and capsule helpers built in.

Node.jsPythonPHPGoRuby

PayingCo/puny-sdks

Core endpoints

The most-used routes. See the full reference for every parameter and field.

POST/v1/links

POST/v1/capsules

GET/v1/links/:id

GET/v1/capsules/:id

DELETE/v1/links/:id

Full API reference

FAQ

Puny questions

A link is a secure short URL with optional password, allowlisting, and auto-expiry that can point anywhere. A capsule stores sensitive information itself and self-destructs after a single view, so the data can't be read twice.

Each link can require a password, restrict access to an allowlist of email addresses or domains, and auto-expire after a set time or a maximum number of opens.

A one-time capsule reveals its contents on the first successful open and is then permanently destroyed, so the same capsule can never be read again.

Yes. Use sandbox keys to create test links and capsules and verify expiry and self-destruct behavior before going live.