Record Click

Stamp the first click on a campaign mail. Called by the web middleware, not a person.

Campaign links are ordinary slideforge.dev URLs carrying ?src=&sid=; Resend's own click tracking, which would rewrite every link through a tracking subdomain, stays off. So the click reaches us the same way any other visit does and this endpoint is what turns a landing into an attributed click.

Unauthenticated for the same reason unsubscribe is: the reader has usually not logged in yet — /console/billing, where the top-up mails point, bounces them through Auth0 first. A sid grants nothing; the only effect it can have is setting one timestamp on the row it names, once.

Silent on an unknown id. The middleware fires this without waiting for the answer, so a 404 would be read by nobody and would only tell a prober which ids exist.