1. Issue a link
POST https://api.bolrach.com/push/v1/apps/YOUR_APP_ID/users/user_8123/preference-access-grants
Authorization: Bearer bt_live_...
{ "idempotency_key": "prefs-user_8123-2026-10-24", "expires_in_seconds": 86400 }
-> 201 { "id": "...", "url": "https://push.bolrach.com/preferences#token=...", "expires_at": "..." }Most apps put that url behind a Notification settings button, and it works in an email footer too. Everything after the # is the secret. A browser never sends a fragment over the network. So the token stays out of server logs and referrer headers, and once our page has read it, the address bar is cleared. Links expire after 24 hours by default; a request can pick anything from 5 minutes to 30 days with expires_in_seconds, and POST /preference-access-grants/{id}/revoke kills one early.
2. Make it yours
The first link an app issues comes with a starter centre in the app's name and three categories. account is always on, and activity and marketing start on, so issuing a link never stops a notification that already goes out. A custom version can replace it at any time:
PUT https://api.bolrach.com/push/v1/apps/YOUR_APP_ID/preference-centre
{ "idempotency_key": "centre-v2", "title": "Northwind notifications",
"branding": { "company_name": "Northwind", "logo_url": "https://cdn.northwind.example/logo.svg", "primary_color": "#0C6446" },
"categories": [
{ "key": "account", "name": "Orders and account", "required": true, "default_opt_in": true, "channels": ["push","email"] },
{ "key": "marketing", "name": "Offers", "default_opt_in": false, "channels": ["push","email"] }
],
"custom_domain": "preferences.northwind.example" }Send each message with the matching category. A person who turned marketing off is skipped for marketing sends and still gets their order updates. With custom_domain, links point at your own host: point that host at us and tell support, and we issue its certificate.
3. Or build it into your app
The same controls ship as a Web Component and as SwiftUI, Android and Flutter views in the SDKs. Pass them the token from the link, as the hosted page does, and never store it.