---
title: Private Links and PINs
description: "Clients reach their pages through private links of the form `yoursite/ap-client/…/` - or `yoursite/?apcwm_token=…` on a site whose permalinks are set to Plain. There is no login. Each link is long and random, and the plugin keeps only a scrambled…"
url: "https://www.ancestorpress.com/docs/cw-private-links/"
updated: "2026-10-05"
category: AncestorPress Casework Manager
---

# Private Links and PINs

Clients reach their pages through private links of the form `yoursite/ap-client/…/` - or `yoursite/?apcwm_token=…` on a site whose permalinks are set to Plain. There is no login. Each link is long and random, and the plugin keeps only a scrambled copy of it.

## The kinds of link

- **Intake** - opens the intake form. Made on the engagement's Intake tab.
- **Client page** (Pro) - the client's own page for the engagement. Made on the Plan & Agreement tab once you have sent the plan.
- **Family share** (Pro) - a trimmed view for relatives. Made on the Client Access tab. See "Family Links (Pro)".

## Copy it when you make it

A new link is shown once, when you create it. Copy it then. If it is lost, revoke it and create a new one.

## PINs

Any link can have a PIN of 4 to 6 digits, for clients who want the extra step. Give it to your client separately from the link. Once they have entered it, their browser remembers it for 12 hours; changing the PIN ends that at once.

## Expiry

You choose how many days a link lasts; 0 means it never expires. The forms start at 30 days for an intake link, no expiry for a client page, and 90 days for a family link.

## Revoking

The Intake and Client Access tabs list their links - when made, PIN or not, expiry, when last opened, and whether each is Active, Expired or Revoked - each with a **Revoke** button; the Plan & Agreement tab shows the client's link with **Revoke this link**. A revoked link stops working straight away. Links are also revoked automatically: every intake link when the form is sent, and every link a client has when you anonymise them.

## What a client sees when a link fails

- A link that is wrong or unknown: "That link is not valid."
- A revoked link: "That link is no longer active. Please ask for a new one."
- An expired link: "That link has expired. Please ask for a new one."
- Ten wrong attempts: "Too many attempts. Please wait fifteen minutes and try again."

Client pages ask search engines not to index them, both in the page and in the server's reply.