One-Time Links That Expire After the First Click

What is a one-time link?

A one-time link is a URL that redirects exactly once. After the first click, it stops working — anyone who tries to follow it later sees an expired-link page instead of the destination. It's a simple way to send a URL where you don't want it forwarded, indexed, or replayed: invite codes, beta access keys, single-use downloads, password reset links, secret hand-offs.

zip1.io makes one-time links a one-line operation: set a click limit (Advanced Options → Max clicks) to 1. There's no separate "secret link" feature, no expiring-token plumbing, and no account. The same control scales up — a click limit of 100 for a beta cohort or 5000 for a campaign — but at 1, it behaves as a strict one-shot.

Zip1 one-time links are click-limited short URLs (a click limit of 1). They stop redirecting after the first open. They are not a Privnote- or OneTimeSecret-style vault for pasting passwords and notes — the destination URL still lives on our servers so we can redirect. Use those tools when the secret itself is the message; use Zip1 when you already have a URL and need the public doorway to close after one click.

Need the link to die on a clock instead of on the first click? Use a self-destructing (expiring) link.

Make one in five seconds

Web form: paste your URL, click "Advanced Options", set Max clicks to 1, click Shorten.

API (no key required, 10 requests a minute per IP, 1,000 links a day):

curl -X POST https://zip1.io/api/create \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/secret-download/abc123",
    "max-clicks": 1
  }'

# Response:
# {"short_url": "https://zip1.io/xK9p3z", ...}

That short URL works exactly once. The first request gets a redirect to the destination; every subsequent request gets the expired-link page (HTTP 400). The original destination URL is preserved exactly — query string, fragments, everything.

When to use a one-time link

{
  "url": "https://example.com/signup?invite=alice-2026",
  "alias": "join-alice",
  "max-clicks": 1
}

What about analytics?

Even after the link expires, the stats page keeps working. You can still see the click totals by country, browser, OS and referrer, and the time of the last click. Anyone with the short link can see its stats. Visitor IP addresses are stored to count unique visitors. They are never shown on the stats page or included in the export.

• Whether the link was clicked, and the time of the last click
• Country, browser, and OS
• The referrer — if they followed the link from somewhere indexable
• Whether a click came from a known bot (so you know if a crawler burned the cap)

For invite-code workflows in particular, that's enough audit trail to verify the right person opened the link and to spot when a preview-link bot consumed the cap before the human got there. (If preview-bot consumption is a concern, see the FAQ below.)

A click cap is not the only way to end a link. If the deadline is a date rather than a headcount, set an expiry instead — or set both, and whichever comes first closes it. See self-destructing links.

How zip1.io compares for a link that works once

OneTimeSecret and Privatebin are great for sharing secrets that live entirely on their server. zip1.io is the right tool when the destination is a URL you control — your own download address, your own signup page — and you want a public-facing link that can't be replayed.

FAQ

• What is a one-time link?

  A one-time link is a URL that works for exactly one click and then stops redirecting. It's useful for invite codes, single-use downloads, beta access keys, and any situation where the link should not be reused or forwarded.

• How do I create a one-time link with zip1.io?

  Set a click limit (Advanced Options → Max clicks) to 1 when creating the link, on the web form or through the API. After the first click the link shows an expired-link page.

• Can I cap a link at more than one click?

  Yes. Any positive integer works. Common caps include 1 (single-use invite), 100 (small list or beta cohort), and 1000 (paid campaign). Once the cap is hit, the link stops redirecting.

• What counts as a "click"?

  Any HTTP request to the short URL that isn't already past the cap. That includes preview crawlers (Slack, Discord, iMessage, LinkedIn).

• What about link-preview bots eating my one-time link?

  If you paste a one-time link into Slack or iMessage, the platform may fetch it once to render a preview, consuming the click. Workarounds: (a) wrap the destination so the preview-fetch goes to a placeholder page that's safe to be eaten, or (b) deliver the link in plain text in a channel that doesn't auto-preview (email subject line, SMS without OG fetching, etc.). zip1.io recognises known preview bots when they open the link and labels them as bots on the stats page, but by default they still open the link and use up a click. Links created with block-bots set turn known bots away, so they don't use up the click limit. The site and emoji forms store that field when you send it. /api/create does not.

• Can I extend a one-time link after it has expired?

  Not currently. Links are immutable once created. If a real visitor missed it because a preview bot used the click, make a new short link and re-share.

• What happens to the analytics after the link expires?

  The stats page keeps working. You can still see the click totals by country, browser, OS and referrer, and the time of the last click. Anyone with the short link can see its stats. Visitor IP addresses are stored to count unique visitors. They are never shown on the stats page or included in the export. The link itself just stops redirecting visitors onward.

• Is this a substitute for end-to-end encryption?

  No. zip1.io stores the destination URL in plaintext on our server (it has to, to redirect you there). One-time links protect against re-use of the public URL, not against server-side disclosure. For true zero-knowledge secret sharing, use OneTimeSecret, Privatebin, or a similar dedicated tool.

• Is this the same as a one-time secret / Privnote link?

  No. Those products store a secret message and typically burn the message after reading. Zip1 stores a destination URL and stops redirecting after the first click (or after N clicks). Different category, different job.

• Do I need an account?

  No. zip1.io has no signup. There is no monthly link cap (500 a day on the site, 1,000 by API) and no paid tier. The API limits creation to 10 links a minute per IP.

Related