Build with Link Protect

Developer access is granted per Discord account. Sign in, open Settings → Developer Accessand send a request — you’ll get a notification once it’s reviewed. Approved developers see a Developer tab in every server dashboard they manage, where API keys and webhooks are created.

API keys are created per server in that server’s Developer tab (up to 5 per server) and grant read-only access to that server’s data. Send the key in the X-Api-Key header (or Authorization: Bearer lp_…). Keys are shown once at creation and stored only as a hash — treat them like passwords.

Base URL: https://link-protect.com/api/v1 · Rate limit: 60 requests/minute per key (HTTP 429 beyond that).

GET /api/v1/stats

Live protection stats for the key’s server.

curl -H "X-Api-Key: lp_your_key" https://link-protect.com/api/v1/stats

{
  "guildId": "1234567890",
  "totalWarnings": 128,
  "warnedUsers": 42,
  "activeBlockers": 6,
  "blockers": { "malware": true, "nitro": true, "invite": false, ... },
  "thresholds": { "kick": 5, "ban": 10, "timeout": 3 }
}

GET /api/v1/trends?days=14

Daily action counts (1–60 days) plus totals and top reasons — the same data behind the dashboard chart.

curl -H "X-Api-Key: lp_your_key" "https://link-protect.com/api/v1/trends?days=7"

{
  "days": 7,
  "total": 23,
  "perDay": [ { "date": "2026-07-17", "warned": 3, "kicked": 0, "banned": 0, "timeout": 1, "count": 4 }, ... ],
  "topReasons": [ { "reason": "Posted a malware link", "count": 9 }, ... ],
  "totals": { "warned": 18, "kicked": 2, "banned": 1, "timeout": 2 }
}

GET /api/v1/check?url=…&deep=1

Threat lookup against the Link Protect database + Google Safe Browsing — the engine behind the public link checker. With deep=1 the redirect chain is resolved server-side and every hop is checked.

curl -H "X-Api-Key: lp_your_key" "https://link-protect.com/api/v1/check?url=bit.ly/abc123&deep=1"

{
  "url": "bit.ly/abc123",
  "domain": "bit.ly",
  "safe": false,
  "category": "phishing",
  "source": "threat-db",
  "reason": "This link redirects to fake-login.ru, which is flagged as phishing…",
  "seenOnServers": 14,
  "redirects": [ { "url": "https://fake-login.ru/discord", "domain": "fake-login.ru", "status": 301 } ],
  "finalDomain": "fake-login.ru"
}

Register up to 3 HTTPS endpoints per server in the Developer tab and pick the events you care about. Deliveries are POSTs with a JSON body, sent within ~10 seconds of the event:

POST https://your-server.com/linkprotect-hook
Content-Type: application/json
X-LinkProtect-Event: link_blocked
X-LinkProtect-Signature: sha256=8f3a…

{
  "event": "link_blocked",
  "guildId": "1234567890",
  "data": {
    "user_id": "9876543210", "username": "scammer42", "channel_id": "111222333",
    "action": "warned", "reason": "Posted a malware link", "warn_count": 2,
    "timestamp": 1784800000
  },
  "sentAt": 1784800005
}

Every delivery is signed: X-LinkProtect-Signatureis the hex HMAC-SHA256 of the raw request body, keyed with your webhook’s whsec_… secret. Verify before trusting:

// Node.js
import crypto from "node:crypto";

function verify(rawBody, signatureHeader, secret) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected));
}

Respond with any 2xx within 6 seconds. Failed deliveries count up — after 25 consecutive failures the webhook is disabled automatically (re-enable it in the Developer tab, which also resets the counter). Use the Test button to send a sample event any time.

Live SVG widgets — no key required, cacheable, safe to hotlink:

<!-- Protected-by badge (style=light for bright pages) -->
<img src="https://link-protect.com/api/badge?guild=YOUR_SERVER_ID" alt="Protected by Link Protect">

<!-- Live stats card -->
<img src="https://link-protect.com/api/embed/stats?guild=YOUR_SERVER_ID" alt="Link Protect stats">

<!-- Voter leaderboard (limit 3–10) -->
<img src="https://link-protect.com/api/embed/leaderboard?limit=5" alt="Top voters">