Setup links
The person claiming a domain often isn't the one who can change its DNS. A setup link hands that one job to a teammate, an agency or an AI agent, and nothing else.
A link as a capability
A session answers "who are you?", and then the server decides what you may do. A skips the first question. Holding the link is the permission, so the link has to be safe in anyone's hands. That's done by making it open as little as possible.
From the owner's click to the helper's check
What keeps it safe to pass around
| Property | Where |
|---|---|
| Random, and stored only as a hash | Same as a session: 32 bytes, SHA-256 in claim_shares.token_hash. A test checks the token never appears in the table. |
| It expires | 30 days, from SHARE_TTL_MS. Long enough to forward, short enough to stop mattering. |
| It stays out of search and referrers | The /setup/<token> page sets robots to noindex and referrer to no-referrer, because the URL itself is the credential. |
| The note is text | Capped at 280 characters by the contract and rendered as text in the email, so it can't carry markup. |
| The page says what it isn't | It opens by explaining that someone asked for help, that the website and email keep working, and that Prufy never asks for a password. |
The same link, for an AI agent
The fourth way to add the record is "Let an AI agent do it". It makes the same kind of link and wraps it in a message to paste into an assistant, written by agentMessage in components/claim/methods.tsx. The message gives the setup page, the same details as JSON at /api/setup/<token>, and four instructions: show what you'll add and wait for an OK, don't touch other records, never ask for passwords, and stop once the domain is verified.
GET /api/setup/<token> // the record, the steps, the status
POST /api/setup/<token>/checks // ask for a check
// This link can't do anything else.
What's tested
apps/web/lib/server/alerts-and-shares.test.ts covers it through the real handlers: a link works with no session, the helper's check verifies the owner's claim, the two share one cooldown, the link stops after 30 days, only the hash is stored, the first open is logged once, another account can't make a link for a claim that isn't theirs, and a verified domain needs no link. The decision is in docs/decisions/0009-alerts-and-setup-links.md.