Signed redirects let your destination server verify that a visitor actually arrived through one of your short links, rather than through a URL someone copied, guessed or fabricated.
What it does
Enable signing under Domain settings, Signature key, and every redirect from that domain carries three extra parameters on the destination URL: ms_sig, ms_exp and ms_alg. The signature is computed with HMAC-SHA3-512 over the destination and expiry, using a key held for the domain, and it is valid for ten minutes.
Your destination server recomputes the signature with the same key and rejects anything that does not match or has expired. Verification examples for several languages are shown in the settings panel.
When this is worth it
- Paid campaigns where the destination is a landing page you do not want scraped or replayed at scale.
- Affiliate or partner traffic where you need to distinguish genuine referrals from fabricated ones.
- Any endpoint that acts on arrival — issuing a token, starting a session, counting a lead — and should only act on traffic that came through a link you control.
The key
The key is generated per domain and shown once, with a copy button. Store it in your destination application's secrets. Regenerating the key invalidates the old one immediately, which will break any server still verifying with it — coordinate the change.
Things to get right
- Clock skew. Ten minutes is not a long window. If your server's clock drifts, valid traffic fails verification. Run NTP.
- Constant-time comparison. Compare the signature with a constant-time function, not string equality.
- Do not strip the parameters upstream. A CDN or a redirect on your side that drops query parameters removes the signature.
- Fail sensibly. Decide in advance what an invalid signature means: a hard rejection, or a flag on the session. A hard rejection combined with a clock problem takes your landing page down.
What it is not
A signature proves a URL was produced by your domain within the last ten minutes. It does not prove who the visitor is, and it does not stop someone forwarding a signed URL within the window. It is a filter against bulk and stale traffic, not authentication.
Signed redirects are on the Growth plan and above.
Find this in your dashboard
- Sign in and select the workspace and domain you want to manage.
- Open Branded Links. Review the article’s steps and your plan’s available controls.
- Save your changes, reopen the record and verify the saved result. For routing changes, check the short link with a test visit.
