Agent-readable docs index: /docs/llms.txt. Full docs in one file: /docs/llms-full.txt. Download /docs/docs.zip to grep all markdown files locally.

Password Protection & Link Expiration

For sensitive documents, internal memos, pre-launch product reviews, or time-sensitive promotions, Shaf provides edge-enforced access security — no middleware, no backend round-trips.
Password Gate
Visitors must enter a passphrase before the redirect fires. An authenticated session cookie is issued on success.
Auto-Expiration
Schedule links to stop working at a precise UTC timestamp. Expired traffic is handled at the edge with zero latency lag.

Setting Password Protection

    When creating or editing a short link, expand the Security & Privacy section by clicking the 🔒 Security toggle.

    Enable Password Protection

    Toggle Password Protection to On.

    Set Your Passphrase

    Enter a strong access password (e.g. Alpha2026!). Passwords are hashed with SHA-256 before storage — the plaintext is never persisted.
    One-way hashing: Once saved, the password cannot be retrieved. Store it in your team's password manager before clicking Save.
    Click Save Link. The lock icon will appear in your links table indicating the link is gated.

The Visitor Experience

When an end-user navigates to the short link, Shaf halts the automatic redirect and presents a branded password entry page. Upon entering the correct passphrase:
  1. An authenticated session cookie is issued (valid for the browser session).
  2. The visitor is transparently redirected to the destination URL.
  3. Subsequent visits from the same session bypass the password gate.

Configuring Automatic Expiration

    Expand the Expiration Section

    Under Link Expiration, toggle Set Expiration Date to on.

    Select the Expiration Timestamp

    Choose your desired date, time, and timezone using the picker. Shaf stores all timestamps as UTC internally.

    Choose the Post-Expiration Behavior

    Informs the visitor that the campaign or resource is no longer available. A branded page is served from the edge.
    Best for: time-limited promotions, event registrations, product launches.
    Click Save. The expiration badge ⏱ Expires DD/MM/YYYY will appear in your links table row.

Edge-Enforced Expiration

Rendering diagram...
Because expiration timestamps are evaluated directly at Cloudflare edge cache nodes, expired links cease resolving the instant the timestamp passes — with zero latency lag and no backend roundtrips.

Troubleshooting

I forgot the password I set — how do I recover it?
Passwords are one-way hashed and cannot be recovered. Open the link editor, toggle Password Protection off and back on, set a new password, and save.
The link is showing as expired but it shouldn't be yet
Check the timezone setting. Shaf stores expiration in UTC — if you selected a local time without adjusting the timezone field, the timestamp may have been offset. Edit the link and verify the UTC equivalent shown in the picker.
Can I combine password protection and expiration on the same link?
Yes. Both controls are independent and can be applied simultaneously. A visitor must both enter the password and the link must not be expired for the redirect to fire.