REDIRECT DESTINATION

Send every scan to the right URL

Use a Redirect to open an external site or application. Pass Tag information in the URL and, for DNA scans, verify the signed redirect token.

A Redirect Destination sends a person to an external URL after they scan a Tag or GS1 Digital Link. Use it when the experience already exists on a website, landing page, application, or service outside TagLink.

Pass information with query parameters

The destination URL can include TagLink-provided parameters and your own static key-value pairs. Your receiving application can use the parameters to identify the Tag or process the request.

Parameter	Meaning
`uid`	Identifier of the physical Tag. It is not a secret or proof of authenticity.
`clientTagId`	Sequential Tag identifier for the customer, starting from 1.
`lastSeenCounter`	Counter associated with the most recently recorded scan; the receiving application may use it in its own validation logic.
Custom parameters	Static values you add, such as a campaign or application identifier.

Do not treat the presence of a UID or counter in a URL as proof that a request came from an authentic Tag. For DNA Redirects, use the verification flow below.

DNA Redirects and `tl_sig`

When a DNA Tag is scanned, TagLink first verifies the NFC scan. After successful verification, it redirects the visitor and automatically appends a signed token in the tl_sig query parameter.

The external application must validate this token before trusting the scan. The token contains signed information associated with the verified scan; it is a verification artifact, not a permanent Tag identifier.

Online verification

Checks the signature and atomically consumes the token. Use it when single-use status and protection against token replay matter.

Offline verification

Checks the signature with TagLink's public key. It cannot tell whether the same valid token was already used.

Method	Endpoint or resource	What it confirms
Online	`POST /api/public/redirect-signature/verify`	Authenticity and whether the token is still unused. A successful verification consumes it.
Offline	`GET /api/public/redirect-signature/public-key`	The token was signed by TagLink. It does not provide server-side single-use checking.

Online verification request

Send the complete value received in tl_sig as signature:

{
  "signature": "<tl_sig token>"
}

For a valid, unused token, the endpoint returns scan information in this form:

{
  "valid": true,
  "tenantId": "...",
  "uid": "...",
  "counter": 123,
  "issuedAt": 1735689600
}

tenantId identifies the customer account; uid identifies the Tag; counter is the scan counter; and issuedAt is the token issuance timestamp.

If the token was already consumed through online verification, the response is:

{ "valid": false, "reason": "ALREADY_USED" }

An invalid signature can return:

{ "valid": false, "reason": "INVALID_SIGNATURE" }

An expired or otherwise invalid token must also be treated as an unsuccessful verification. Do not process any response with "valid": false as a new authenticated scan.

Recommended DNA Redirect flow

The visitor scans a DNA Tag.
TagLink verifies the scan and creates a signed tl_sig token.
TagLink redirects the visitor to the configured external URL.
The external application reads tl_sig from the query string.
The application sends it to the online verification endpoint.
If the result is "valid": true, the application processes the request according to its own logic. If it is invalid or already used, the application rejects it.

Validate before trusting the redirect

The presence of a tl_sig parameter alone proves nothing. Use online verification when the receiving application needs a single-use guarantee and protection against replay.

Return to Destinations to compare Redirects with TagLink's other destination types.

Send every scan to the right URL

Pass information with query parameters​

DNA Redirects and tl_sig​