We shipped Sign in with Google. If typing a password every time felt like the wrong amount of friction for a link shortener, that's gone now -- one click on the login screen and you're in with the Google account you already use everywhere else.
What actually shipped:
One-click sign-in and sign-up with Google, right next to email/password on the login screen.
Same secure session underneath as email/password auth -- OAuth is a new front door, not a different security model.
Already have an account under that email? Signing in with Google links to it instead of creating a duplicate.
Under the hood this plugs into the same session infrastructure we already shipped, so nothing about how sessions work changed -- just a faster way to reach them.
Try it at app.morphr.link -- and if you're curious what's next, the roadmap has the rest.
A short link is only as good as how fast it redirects. We moved that as close to the visitor as it gets.
Redirects now resolve at the CDN edge with a long cache, so a click doesn't wait on a round trip to our origin. The part we didn't want to sacrifice: freshness. Change where a link points, and the update queues a purge that reaches the edge in seconds instead of waiting out the cache.
What shipped:
Redirects served from the edge on every click, not from origin.
Changes propagate in seconds via automatic purge, not slow cache expiry.
Built to hold up as click volume grows, not just today's traffic.
Typing a slug, hitting save, and getting told it's taken is a bad loop. So we closed it.
Slug availability now checks in real time as you type -- and if the one you want is gone, we hand you suggestions instead of leaving you to guess again.
What shipped:
Instant availability check as you type a slug, before you submit.
Suggested alternatives the moment your first pick is taken.
Fewer failed submits, faster to a working link
Folders and tags to organize what you create are built on the API too -- the app screens to manage them are next.
Before anything else works, you need to be able to make a link. So that's where we started.
Full CRUD for short links now lives in the API -- create, read, update, and delete, all callable directly, not locked behind the app UI. And when you create one, you're not stuck guessing which domain it'll live on: pick from the domains actually available to your workspace right there in the flow.
What shipped:
Create, update, and delete links via the API -- script it, integrate it, build on it.
Domain picker on link creation -- see your workspace's domains, choose the right one per link.
The base every other link feature builds on -- targeting rules, expiration, and everything else on this roadmap sits on top of this.
We rebuilt authentication from the ground up: email + password, required email verification, and sessions backed by short-lived signed JWTs instead of long-lived cookies that quietly become a liability. Every request gets checked against that token before anything happens -- nothing slips through unauthenticated.
Here's what shipped:
Email + password sign-in, gated behind email verification so unverified accounts can't touch your data.
Secure sessions issued and verified via ES256-signed JWTs -- the same auth layer every other Morphr service trusts.
Workspace roles, built into the API -- editor and viewer permissions already exist under the hood. The team-management screen to invite people and assign roles is next.
This is the foundation everything else on the roadmap stands on. Up next: Google & Apple sign-in for one-click login, and the frontend to go with the roles we already built.
You shouldn't have to think about how sign-in works -- just that it's fast and it holds.
Sign-in runs on email + password with required email verification, backed by sessions issued as short-lived, ES256-signed JWTs instead of a plain session cookie. Every authenticated request gets that token checked before anything happens.
Why it matters to you:
You stay signed in -- close the tab, come back tomorrow, still logged in. No mystery logouts.
Verified accounts only -- email verification is required before an account can touch any data, which keeps throwaway and spam signups out from day one.
It's the foundation, not a bolt-on -- Google/Apple sign-in and workspace roles both build on this exact same session layer.
We wanted the boring, load-bearing part of the product -- token expiry, verification, session handling -- solid before building the exciting parts on top of it. Everything else on this roadmap sits on this.