Agentic Fabriq
Linkly
MARKETING · MARKETING
Short links, their conversions, custom domains, and webhooks in the account they connected.
Connecting Linkly in practice
A Linkly API key can be sent three ways — bearer header, HTTP Basic as the username, or an `api_key=` query parameter — and a request for a workspace the key cannot reach returns 404, not 403, because "workspaces you don’t belong to are not distinguished from ones that don’t exist". The analytics endpoints also draw on a usage allowance that resets each billing period, and on a paid plan exhausting it automatically adds a billed API pack to the subscription so calls keep working.
Scopes that draw scrutiny
API keyOne credential from workspace settings, with no scope mechanism. Most endpoints are workspace-scoped, so the practical boundary is which workspaces the key belongs to rather than what it may do inside one.api_key query parameterAccepted for convenience, and Linkly warns against it in production: "query-string keys can leak into server logs, browser history, and Referer headers".
Rate limits
- Requests are rate-limited; over the limit returns 429 with code `rate_limit_exceeded` and the current usage and limit in the response body. The numeric ceilings are not stated on the reference.
- Analytics endpoints — clicks, counters and exports, including link exports — additionally draw on a usage allowance that resets each billing period.
- When a paid workspace uses all of its analytics requests, an API pack is added to its subscription automatically rather than the requests failing.
Worth knowing
- A billing side effect is the real risk here: an unbounded analytics loop buys API packs instead of getting throttled, so the failure shows up on the invoice rather than in the logs.
- Errors carry a stable machine-readable `code` (bad_request, unauthorized, forbidden, not_found, rate_limit_exceeded, internal_error), except validation failures, which return 400 with field-level details such as `{ "slug": ["is invalid"] }` instead of that envelope.
- Almost every path is workspace-scoped, so the first call in any integration is GET /workspaces to resolve an ID before anything else works.
- The API host is api.linklyhq.com/api/v1 while the docs and app live on linklyhq.com and app.linklyhq.com, so the three hostnames are easy to confuse.
Checked against Linkly API reference (OpenAPI) (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Linkly behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.