Subdomains

Every short link can also be reached from a dedicated subdomain: register promo and https://promo.inkpage.link redirects to the target link, keeping the full link pipeline (password, unsafe confirmation, geo routing, cloaking, and analytics).

Creating a subdomain

1. Open Dashboard → Administration → Domains
2. New subdomain → enter the label (DNS rules apply: 1–63 characters, letters, digits, and inner hyphens)
3. Choose the target:
   • New link → paste a destination URL; the short link is created in the same transaction and shows up in the Links dashboard like any other link. The slug is generated, not typed.
   • Existing link → pick one from the searchable list
4. Copy the generated URL and use it anywhere

Both targets are mutually exclusive: POST /api/domains/create takes either slug or url, never both. The one-step flow needs links:write on top of domains:create, so a subdomain can never be used to create links a caller could not create directly.

A subdomain establishes the FK to the link it points at. When the label already exists, or when the link insert and the domain insert do not both succeed, nothing is written.

The link picker only lists links that have not expired, so a subdomain can never be pointed at a missing target. From the Links dashboard, a link's action menu also offers Add subdomain, which opens the same form with the link already selected.

Subdomains can be paused (kept for later) or deleted at any time. Reserved infrastructure names such as www, api, and admin are rejected, and a subdomain may only point at a link that has not expired.

How resolution works

• Only subdomains of inkpage.link are managed; the apex host keeps serving the dashboard and path-based short links as usual.
• The path on a subdomain is ignored — every path resolves the target link, which keeps the password and unsafe-confirmation form posts working on the subdomain itself.
• www.inkpage.link answers with a permanent redirect to the apex.
• Unknown or paused subdomains return 404 instead of mirroring the app.

Permissions

Listing requires domains:read (every role); creating, pausing, resuming, and repointing require domains:create; deleting requires domains:delete — both granted to administrators, superadmins, and power-users (limited to their own subdomains). The one-step create path additionally requires links:write. Every change is written to the audit log.

Local testing

Browsers resolve any *.localhost name to the loopback address, so local subdomains work without DNS changes: run pnpm dev and open http://promo.localhost:7465.

Production routing

wrangler.jsonc already routes *.inkpage.link/* to the Worker and the Cloudflare zone's wildcard certificate covers the host, so no extra DNS or TLS setup is needed after the first deploy.