Invoicing
Share links
Private links let your client open a document, pay it or accept it without an account. Links cannot be guessed, expire, and can be revoked at any time.
A share link is a private web address for one document. Your client opens it in any browser, with no account and no password, to see the document and act on it: pay an invoice on the pay page or accept an estimate on the estimate page. Copy it into any channel you like, or let the email send it for you.
Kinds of links
| Link | Opens | Used for |
|---|---|---|
/pay/[token] | the pay page | invoices: view, pay by card, see bank details, upload payment proof |
/estimate/[token] | the estimate page | estimates: accept or request changes |
/v/[code] | the verification page | anyone holding the PDF checks it is genuine |
/portal | the client portal (week of 11 January 2027) | all of one client's documents with one business, through a single-use sign-in link |
All of these pages live on freeinvoiceautomation.com, are themed with your business's logo and colour, and carry no analytics, no ads and no app chrome.
How links are kept safe
Every link token follows the same rules:
- Cannot be guessed. Each token is 256 bits of randomness.
- Stored hashed. We keep only a hash of the token, so even someone reading our database could not rebuild your links.
- Single-purpose. A pay link only opens the pay page for its own invoice; it cannot be used for anything else.
- Expiring. Pay links last 90 days to start with, and are renewed when the document is sent again or a reminder goes out (proposed). Estimate links follow the estimate's validity, 30 days to start with. Expired tokens are deleted 30 days after they expire.
- Revocable. You can cancel a link at any moment. Voiding an invoice cancels its pay links automatically.
Token pages also tell browsers not to pass the link on to other sites, cannot be embedded in other sites' frames, and are rate limited per visitor, so links cannot be leaked or flooded easily.
Anyone who has the link can open the document, so share it only with your client. If a link was sent to the wrong person, revoke it and create a new one.
Share and revoke in the web app
Send the document first
A share link is for a sent document. Sending gives it its number and freezes it (Send a document).
Copy the link
Click Copy link on the document. The pay link is copied, ready to paste into chat, your own email or a message.
Revoke when needed
Revoke the link from the document. Anyone who opens it afterwards sees "link no longer valid" and no document data.
Through the API
Create a link for a document, then revoke it by its id:
curl -X POST "https://api.freeinvoiceautomation.com/v1/documents/0193f2b4-5a6b-7c8d-9e0f-1a2b3c4d5e6f/share-links" \
-H "Authorization: Bearer $FIA_API_KEY" \
-H "Idempotency-Key: 4d6f8a0c-share-inv-0007"curl -X DELETE "https://api.freeinvoiceautomation.com/v1/share-links/0193f2d1-8b2c-7d3e-9f4a-5b6c7d8e9f01" \
-H "Authorization: Bearer $FIA_API_KEY" \
-H "Idempotency-Key: 4d6f8a0c-unshare-inv-0007"Once a share link exists, the document returned by the API includes its pay_url.
| Task | Endpoint |
|---|---|
| Create a share link | Create a share link |
| Revoke a share link | Revoke a share link |
| What the pay page reads | Get the pay page |
| What the estimate page reads | Get the estimate page |
Over MCP, send_document delivers the document with its link. The share link capabilities themselves are in the REST API and the CLI, not on the MCP tool list.
What your client sees when a link stops working
| Situation | Client sees | API error |
|---|---|---|
| The token does not exist | link not valid | token_invalid (404) |
| The link expired | link no longer valid | token_expired (410) |
| You revoked it, or the invoice was voided | link no longer valid | token_revoked (410) |
In every case the page shows no document data.
Rules and edge cases
- Links never mark anything paid. Opening a pay link, or returning from checkout, changes nothing. An invoice is paid only when the payment rail confirms it or you record the payment.
- Your client never needs a password. Clients have no accounts. The link, or a single-use portal sign-in link, is their access.
- Uploads through a link are private. Payment proofs a client uploads are stored privately and limited in size and type; images are re-encoded.
Permissions
| Action | Permission key |
|---|---|
| Create, copy and revoke share links | documents.send |
| See a document's links | documents.view |