Share links

A share link is a creator's PIN-gated public page. See the Shareable creator pages guide for what a creator actually sees.

The URL is derived from the creator id

There is no share-link identifier to store or look up. Every page lives at:

https://www.trackagoat.com/share/creator/<creator_id>

So any creator id from any endpoint can be turned into a link with string concatenation. The url field is returned for convenience, but you never need to fetch it.

The corollary is that the URL is not a secret — the 4-digit entrance PIN is the access control. Unlock attempts are rate limited and locked out after 10 failures.

Permissions

Every share-link endpoint requires two things:

1. The right API key scope (read to fetch, write to modify).
2. The key's owner must be an org admin. Creating a public link is a trust decision, so a write-scope key belonging to a non-admin still gets a 403.

PIN visibility

PINs are omitted by default. This is deliberate: a read-scope agent sweeping /api/v2/creators should not pull every entrance PIN in the org into its logs.

The share_link object

{
  "url": "https://www.trackagoat.com/share/creator/3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "enabled": true,
  "sections": ["analytics", "payouts"],
  "pin": "4821",
  "created_at": "2026-07-29T14:02:11.482Z"
}

Embedded on creator responses

GET /api/v2/creators and GET /api/v2/creators/{id} both carry a share_link field — null when the creator has no page. No second call is needed to list every creator's link.

curl -H "Authorization: Bearer tga_<key>" \
  "https://www.trackagoat.com/api/v2/creators?project_id=<uuid>"

{
  "data": [
    {
      "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "display_name": "Holden K",
      "handle": "holden.k",
      "share_link": {
        "url": "https://www.trackagoat.com/share/creator/3fa85f64-5717-4562-b3fc-2c963f66afa6",
        "enabled": true,
        "sections": ["analytics"],
        "created_at": "2026-07-29T14:02:11.482Z"
      }
    }
  ],

Add include_pin=true with an admin-scope key to include PINs:

curl -H "Authorization: Bearer tga_<admin_key>" \
  "https://www.trackagoat.com/api/v2/creators?include_pin=true"

GET /api/v2/creators/{id}/share-link

Returns the creator's share link, or null data if they don't have one.

Query parameters

curl -H "Authorization: Bearer tga_<key>" \
  "https://www.trackagoat.com/api/v2/creators/<creator_id>/share-link"

POST /api/v2/creators/{id}/share-link

Creates the page, or replaces the settings of an existing one (and re-enables it if it was disabled). Requires the write scope.

Body

At least one of show_analytics / show_payouts must be true, or the request returns 400 no_sections.

curl -X POST -H "Authorization: Bearer tga_<key>" \
  -H "Content-Type: application/json" \
  -d '{"show_analytics": true, "show_payouts": true}' \
  "https://www.trackagoat.com/api/v2/creators/<creator_id>/share-link"

Returns 201 with the full object including the PIN. Supports Idempotency-Key.

PATCH /api/v2/creators/{id}/share-link

Requires the write scope. Send only the fields you want to change.

Any PIN change — via pin or regenerate_pin — immediately invalidates every active unlock session, so anyone currently viewing the page must re-enter the new PIN. The new PIN is returned in the response.

# Rotate the PIN
curl -X PATCH -H "Authorization: Bearer tga_<key>" \
  -H "Content-Type: application/json" \
  -d '{"regenerate_pin": true}' \
  "https://www.trackagoat.com/api/v2/creators/<creator_id>/share-link"
 
# Turn the page off without deleting it
curl -X PATCH -H "Authorization: Bearer tga_<key>" \
  -H "Content-Type: application/json" \
  -d '{"enabled": false}' \
  "https://www.trackagoat.com/api/v2/creators/<creator_id>/share-link"

Returns 404 if the creator has no share link — use POST to create one.

DELETE /api/v2/creators/{id}/share-link

Requires the write scope. The URL then renders the same "not available" page as a disabled link.

curl -X DELETE -H "Authorization: Bearer tga_<key>" \
  "https://www.trackagoat.com/api/v2/creators/<creator_id>/share-link"

{ "data": { "deleted": true }, "error": null, "meta": null }

POST /api/v2/share-links/bulk

Creates or updates pages for up to 200 creators in one call. Requires the write scope.

Body

curl -X POST -H "Authorization: Bearer tga_<key>" \
  -H "Content-Type: application/json" \
  -d '{"creator_ids": ["<uuid>", "<uuid>"], "show_analytics": true, "pin_mode": "unique"}' \
  "https://www.trackagoat.com/api/v2/share-links/bulk"

{
  "data": [
    {
      "creator_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "url": "https://www.trackagoat.com/share/creator/3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "pin": "4821",
      "sections": ["analytics"],
      "status": "created"
    },
    {
      "creator_id": "00000000-0000-0000-0000-000000000000",
      "url": null,
      "pin": null,

Every PIN is returned, since a bulk create is the moment you distribute them. Creator ids outside the key's organization come back as skipped rather than an error — the endpoint never confirms whether an id exists elsewhere. Supports Idempotency-Key.

Errors