Lock a code: password, expiry, scan cap, geofence

Where the gates live

Gates belong to a code, not to a routing flow, so you set them on the code itself rather than on the canvas.

1. Open Links. This is the list of every dynamic code in the workspace.
2. Click the name of the code you want to lock. A detail panel opens beside the list, with the code's short address at the top.
3. Switch to the Smart rules tab and scroll to the Gates section. Access control holds the password and the scan cap; Geofencing and Expiry are their own blocks below it.
4. Set what you need, then press Save. The button quotes the cost before you press it · it reads Save · 5 credits for one change, and more if you changed several gates at once.

A hint above the section reads "Checked before the flow runs: password, geofencing, scan cap, expiry, preview." That is naming the set of gates, not the sequence · the real order is further down this page.

What each gate does

• Require a password · turn the switch on and type one. Scanners must enter it before the redirect happens. The field's own hint says so: "Scanners must enter this password before the redirect." Once saved, the panel reads "A password is set. Type a new one to replace it." · it never shows you the password back, so keep your own copy.
• Scan cap · a number. "The link pauses after this many scans. Empty = no cap." Past the cap the scanner gets a paused notice instead of the destination. The counter is approximate under heavy concurrent scanning, so treat a cap as a ceiling rather than an exact accounting of the last scan through the door.
• Expiry · set Expires at ("In your local time. Clear the date to remove the expiry."). Optionally set After expiry, send to, a URL for late scanners. "Leave empty to show a friendly expired notice instead."
• Geofencing · choose a Mode: Allow only listed countries or Block listed countries. List the Countries as "2-letter ISO codes, comma separated: US, IL, DE". Blocked visitors go to takes a URL, and "Leave empty to show a friendly region notice instead."

The order they actually run in

This matters more than it sounds. The gates are not checked in the order they appear on screen, and a code carrying two of them fails at the first one that trips:

1. Expiry beats everything. An expired code never renders the password form, never consults the country list and never reaches the hosted page.
2. Geofencing next. A scanner outside the allowed region is refused before they are ever asked for the password.
3. Password after that. Repeated wrong guesses from one address are throttled.
4. Scan cap last of the four, then routing runs and the code resolves normally.

So if you set an expiry and a password and people report the password box has vanished, the code expired · check Expires at before you touch the password.

What the scanner sees

When you leave the fallback URL empty, the person scanning gets a plain notice rather than a dead end or an error page. Worth knowing, because these are the words your customers will read:

• Turned away by geofencing · a page headed "Not available in your region", explaining that the owner limited the code to certain countries.
• Past the scan cap · "Link closed", with the reassurance that "The code itself is safe, and its owner can reopen it at any time." Raising or clearing the cap brings it back.
• Past the expiry · "Link expired".

None of these is a broken code, and none of them is a 404. A gated code that turns someone away still tells them a human made that decision on purpose.

What it costs

The tab states the same rule beside the button: each rule you add, change or remove costs 5 credits, nothing is refunded, and a save that changes no rule is free. Opening the tab to look costs you nothing.

Four things that surprise people

• Allow mode fails closed · if we cannot resolve which country a scan came from, an allow-list refuses it. That is the safe default for a restricted campaign, but it means a small number of legitimate scans can be turned away. If you would rather let unknowns through, use Block listed countries and name the countries you are excluding instead.
• A blocked scanner sent to a URL is a real scan · if you fill in Blocked visitors go to, that redirect is served like any other destination, so it is tracked and it bills 1 credit. Leaving the field empty shows the region notice instead, and that costs nothing. Same for After expiry, send to.
• A password is a gate, not encryption · it stops a casual visitor reaching the destination. It is checked on the redirect path with a per-address throttle behind it, which is what makes guessing impractical, but the destination itself is an ordinary URL that anyone holding it can open directly. Do not put anything genuinely confidential behind it and rely on the gate alone.
• Gates outlive a routing flow · if you later remove a flow from the code, the confirmation says it plainly: "Gates (password, cap, expiry) stay." Removing your routing does not quietly unlock the code.

Which gate for which job

• A private preview for a client · password. The code can go on a printed proof and only the people you told can open it.
• An event badge or a seasonal menu · expiry, with After expiry, send to pointed at next year's page, so a code found in a drawer lands somewhere useful rather than on a notice.
• A limited redemption · scan cap. The first N scans get the offer and the rest see a paused notice.
• A region-restricted promotion · geofencing in block mode, so scans you did not plan for are excluded without turning away anyone whose location is unclear.

Gates decide whether a scan gets through. Deciding where it goes · by country, language, device or time · is routing, and that lives on the flow canvas. See routing for that half.

None of this changes the printed symbol. A gated code encodes the same https://tap2u.link/your-slug it always did, so you can add or lift a gate on something already in the world.