GetLinkFast API and MCP server

What it is for

• Agencies and SEO teams: connect your internal tools and tracking dashboards to your account. Catalog, cart, orders and statuses are all readable as JSON.
• AI agents: ask Claude Code or Cursor “find me 5 finance sites with DR 40+ and order them”. The agent searches, shows you the summary and only orders once you approve.
• Make, n8n, Zapier: an HTTP module and a key are all you need.

The API sells guest posts (guest_post), link insertions (link_insertion) and SEO/GEO packs, with credits only. Buying credits and the other offers stay in the dashboard.

Create a key

1. Open Dashboard → API access.
2. Name the key (for example “Claude agent” or “Make reporting”) and choose its scopes. On a key that can order, you can set a per-order cap and a 24-hour cap.
3. Copy the key. It starts with glf_live_ and is shown only once: we keep only a hash of it.
4. Send it in the header of every request: Authorization: Bearer glf_live_…

At most 10 active keys per organization. A revoked key stops working immediately, as do the keys of a member who leaves the organization. Keep the key out of your code repositories: whoever holds it acts on behalf of your organization.

Key scopes

Each key carries one or more scopes. A request without the required scope receives 403 insufficient_scope, and an AI agent only sees the tools it is allowed to use.

Quick start

Every route starts with https://www.getlinkfast.com/api/v1. Keep the www: the address without www redirects, and an HTTP client no longer sends the Authorization header after a redirect.

Amounts are in euros excluding VAT. Responses are JSON, with snake_case fields.

curl https://www.getlinkfast.com/api/v1/account \
  -H "Authorization: Bearer glf_live_…"

curl "https://www.getlinkfast.com/api/v1/sites?dr_min=40&language=fr&product=guest_post&sort=dr&dir=desc&page_size=10" \
  -H "Authorization: Bearer glf_live_…"

curl -X POST https://www.getlinkfast.com/api/v1/cart/items \
  -H "Authorization: Bearer glf_live_…" \
  -H "Content-Type: application/json" \
  -d '{"site_id":"8a1f0c3e-5b7d-4e2a-9c61-0f3b2d4e6a17","product_type":"guest_post","target_url":"https://www.example.com/invoicing","anchor":"invoicing software","topic":"How to choose invoicing software for a small business"}'

Replace site_id with the id of a site from step 2. Never send a price: the server calculates it.

curl -X POST https://www.getlinkfast.com/api/v1/checkout \
  -H "Authorization: Bearer glf_live_…" \
  -H "Idempotency-Key: order-2026-10-14-001"

The response gives the order id, the amount debited and your remaining balance. Then track its progress with GET /orders/{id}.

Ordering with credits

The API orders with credits only and never triggers a card payment. Credits are topped up in the dashboard.

An order takes the guest_post and link_insertion lines of the cart. Other lines, added from the dashboard, stay in the cart and are listed in skipped_items.

No cap by default: your balance is the only limit. On a key that can order, set a per-order cap and a cap over a rolling 24 hours. An order that exceeds them is refused (403 spending_limit_exceeded, with the remaining amount), with no debit.

Insufficient balance: 402 insufficient_credits, with the missing amount and the link to the Credits page, to pass on to someone on your team. Nothing is debited.

After that, everything works as from the dashboard: confirmation email and tracking in the Orders screen, where the order carries the name of the key that placed it.

The Idempotency-Key header

• Required on POST /checkout and POST /packs/orders: 8 to 128 printable ASCII characters, no spaces. Without it: 400 idempotency_key_required.
• One value equals one purchase intent. Sending the same value again returns the original order (200, "replayed": true) with no second debit, even if the cart has changed since.
• After a timeout or a network failure, retry with the same value: you will not pay twice.
• For a new purchase, generate a new value, a UUID for example.
• On POST /checkout as on POST /packs/orders, a value already used for another purchase is refused: 409 idempotency_conflict, with no debit. For a pack, the same value sent with different content is refused too.
• On the MCP side, the confirmation token plays this role: you have nothing to generate.

Limits

• 120 requests per minute per key for reading, and as many again, separately, for the cart: one does not eat into the other.
• 10 calls per minute per key to the purchase routes or tools — replays, refusals and the MCP summary step included.
• 300 HTTP requests per minute per key on the MCP server. Each tool called also counts toward the limit of its scope.
• Beyond that: 429 rate_limited. The wait, in seconds, is given by the Retry-After header over HTTP, and by details.retry_after_seconds in an MCP tool result.
• At most 100 results per page (page_size).
• Request body: 1 MB at most.

Error codes

Every error has the same shape. Test code: it is stable. message is in English and meant for the developer; details names the faulty field or the amounts.

{
  "error": {
    "code": "insufficient_credits",
    "message": "Not enough credits for this order. Nothing was debited. Ask a human to top up at credits_url, then retry with the same Idempotency-Key.",
    "details": {
      "missing_amount": 42,
      "credits_url": "https://www.getlinkfast.com/dashboard/credits"
    }
  }
}

MCP server

The MCP server gives your AI agent the same functions as the API, with the same key. Its address: https://www.getlinkfast.com/api/mcp.

Claude Code

One command in your terminal:

claude mcp add --transport http getlinkfast https://www.getlinkfast.com/api/mcp --header "Authorization: Bearer glf_live_…"

Cursor

In ~/.cursor/mcp.json. Avoid a project's .cursor/mcp.json file: it often ends up in the repository, along with the key.

{
  "mcpServers": {
    "getlinkfast": {
      "url": "https://www.getlinkfast.com/api/mcp",
      "headers": {
        "Authorization": "Bearer glf_live_…"
      }
    }
  }
}

Claude Desktop

Claude Desktop does not send custom headers to a remote server, so it cannot pass on your key. It will connect natively through the OAuth connection planned for an upcoming release. For now, use Claude Code or Cursor: they send the key in the Authorization header.

The tools

The agent only sees the tools allowed by the key's scopes: a key without the right to order has no purchase tool.

read

search_sitesget_sitelist_site_pageslist_categoriesget_accountlist_ordersget_orderget_auditquote_packlist_auditsget_plan

cart

get_cartadd_to_cartupdate_cart_itemremove_cart_itemadd_audit_pagerun_auditcancel_planned_link

purchase

checkoutorder_packplan_links

Two-step purchase

1. The agent calls checkout or order_pack without confirmation_token: nothing is debited. It receives the summary (lines, total, balance after debit, remaining cap) and a confirmation_token.
2. It shows you this summary. If you accept, it calls the tool again with the confirmation_token: the order is placed and debited.
3. The token is valid for 10 minutes. If the cart, a price or the key changes in the meantime, it is refused (confirmation_expired) and the agent repeats step 1. Calling again with the same token after a network failure returns the same order, with no second debit.

Hand-written client

The server is sessionless: each JSON-RPC message is sent as POST and the response comes back as JSON. Send Accept: application/json, text/event-stream and Content-Type: application/json, otherwise the server responds 406. GET and DELETE respond 405.

curl -X POST https://www.getlinkfast.com/api/mcp \
  -H "Authorization: Bearer glf_live_…" \
  -H "Accept: application/json, text/event-stream" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Audit and plan

An agent can audit a site, then spread links over several months from the report. Four steps, with the MCP server tools.

1. run_audit starts the full audit of a domain: technical checks, ChatGPT visibility and the sites where a link would help. Allow a few minutes. Nothing is debited, and the report is unlocked with the organization's audit quota when it has one. Limit: 10 audits per key per 24 hours; asking again for the same domain within the hour returns the existing audit.
2. get_audit returns the status and the current step, then the report in summary once the status is ready. Call it every 30 to 60 seconds. list_audits lists the organization's audits, newest first.
3. plan_links builds a calendar from a ready audit: a monthly budget in euros excluding VAT (at least €100), 2 to 12 months, and optionally a start date and the pages to target. Like a purchase, it takes two steps. Without a token nothing is saved: the agent receives the calendar (links, send dates, total) and a confirmation_token valid for 10 minutes. After your approval it calls the tool again with the same fields and the token, and the plan is saved.
4. get_plan follows each link: target page, anchor, price and state (scheduled, ordered, published, cancelled or failed, with the cause of a failure such as insufficient_credits). cancel_planned_link cancels a link planned through the API, or all those of a domain not yet ordered. Links scheduled by our team stay in place: team_planned for one link, skipped_team_planned for their number.

Nothing is debited when the plan is saved. Each link is debited in credits on its send day, at the price re-read that day, during the daily morning pass (around 06:20 UTC). If the balance is short that day, the link is not ordered and shows as failed in get_plan. A link that is already ordered can no longer be cancelled.

Scopes: run_audit and cancel_planned_link need the cart scope, plan_links needs purchase, and get_audit, list_audits and get_plan need read. The key's spending limits apply to planned links.

In the dashboard, the Delegation page shows these links in the “Scheduled links” block. The organization owner can remove the links planned through the API there. Those planned by our team are read-only.

Reference

Each route with its scope and its matching MCP tool. Parameters, response schemas and errors route by route: the OpenAPI 3.1 description.

A question about the API? Write to us and someone on the team will answer.