Mint a share link that resumes a connect flow from a server-side prefill

Forward-to-a-colleague. The widget posts the domain(s) a teammate should connect plus an arbitrary prefill (the widget config to resume); the control plane stores that server-side under an opaque token and returns the absolute link (ends /share/{token}) and a job_id. Every domain the link targets must be one the calling token may act on: a share link never widens a domain-bound token's reach. The link's server-side prefill is read back by GET /share/{token}, which the teammate's widget bootstraps from instead of a URL that carries the config in the clear. The share token EXPIRES 30 days after it is minted.

Share by email. With recipient_email, CustomDomain™ also emails the link to that address together with the DNS records the domain needs (the records of this application's connection for it when one exists, otherwise the default set) and your optional note. The email names the application as the product that asked. A malformed address is a 400 invalid_request; so is recipient_email without a domain or domains. Sending is capped at 3 emails per domain per application and 50 per application every 24 hours, and 10 per client IP address per hour; over any cap the call is a 429 rate_limited and no link is minted. When the email cannot be sent the link is still returned, with email_error: "not_sent", so the widget can offer to copy it instead.

From a server. An API key mints a link for application_id (an application in the key's tenant, 404 otherwise) or for the key's own application, and the teammate's flow then connects the domain into that application. A member's key needs a role that operates apps. A widget JWT always shares for its own application.