---
title: "Create a setup link to forward to the domain's DNS admin"
method: POST
path: "/api/v1/sessions/{token}/shared-setup-link"
tags: ["Sessions"]
---

# Create a setup link to forward to the domain's DNS admin

`POST /api/v1/sessions/{token}/shared-setup-link`

## Request

- Base URL: `https://app.dodomain.io`
- URL: `https://app.dodomain.io/api/v1/sessions/{token}/shared-setup-link`
- Auth: none required

The person who starts a connect flow is often not the person who can edit DNS. This mints a SECOND, narrower link for that person: `setupUrl` opens a page showing the integrator's branding, the domain, the exact records to add and a **Verify** button — and nothing else. No one-click flow, no `returnUrl` back into your product, and never the `dd_sess_` session token itself, so it is safe to forward to a stranger in a way the connect link is not.

Authorized by the session token, exactly like `verify`, so the hosted page calls it from the browser and your server can call it with the token it minted. The link lives exactly as long as the session (`expiresAt` is the session's) and answers `410 expired` with it. **Calling this again ROTATES the link**: the previous `setupUrl` stops resolving the moment the new one is returned — there is never more than one live setup link per session.

A verify pressed from the setup page finalizes the connection and fires `connection.verified` / `session.completed` exactly as a verify from the hosted page does; the only trace of which door was used is on the session's attempt log in the dashboard.

## Path parameters

- `token` string, required

## Response `200`

Success.

- SharedSetupLinkResponse
  - `expiresAt` string, date-time, required
  - `setupUrl` string, required

## Other responses

- `404`: `404 not_found` — The addressed resource does not exist, or the caller does not own it — the two collapse to one status on purpose, so an id cannot be enumerated by a caller who does not own it.
- `410`: `410 expired` — The connect session's 24-hour lifetime has elapsed. Returned before any verification, metering, or webhook work happens.
- `429`: `429 rate_limited` — Rate limited. `Retry-After` (seconds) is set and `details.retryAfterSeconds` repeats it. Branch on `details.reason`: `request_rate` means the caller is calling too fast (`details.limit` carries the cap), `recently_checked` means this one connection was DNS-checked inside its cooldown.
- `500`: `500 internal` — An unhandled server-side failure. Reported to our error tracker; safe to retry.

---

[API](https://skmtc.dev/dodomain/apis/dodomain-api.md) · [All operations](https://skmtc.dev/dodomain/apis/dodomain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dodomain/apis/dodomain-api/revisions/44cfb944de58?raw)