diff --git a/apps/backend/src/__tests__/config-management.test.ts b/apps/backend/src/__tests__/config-management.test.ts
index 7fd1d4a..a152427 100644
--- a/apps/backend/src/__tests__/config-management.test.ts
+++ b/apps/backend/src/__tests__/config-management.test.ts
@@ -1,4 +1,5 @@
 import type { Envs } from '../lib/envs'
+import { Buffer } from 'node:buffer'
 import { rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -138,11 +139,12 @@ async function makeMutableApp(managementKey = 'mgmt-secret') {
   database.exec('pragma foreign_keys = ON')
   const db = drizzle({ client: database, schema })
   runMigrations(db)
+  const authRepos = makeAuthRepos(db)
   const downloadsRepository = new DownloadsRepository(db)
   const configService = await ConfigService.fromFile({ path, connectorManager, downloadsRepository })
-  const app = getManagementApp({ environment: 'test', managementKey, connectors: connectorManager, configService })
-  const mainApp = getApp(makeEnvs(managementKey), config, connectorManager, { downloadsRepository, ...makeAuthRepos(db) })
-  return { app, mainApp, path, connectorManager, downloadsRepository, database }
+  const app = getManagementApp({ environment: 'test', managementKey, connectors: connectorManager, configService, apiKeysRepository: authRepos.apiKeysRepository })
+  const mainApp = getApp(makeEnvs(managementKey), config, connectorManager, { downloadsRepository, ...authRepos })
+  return { app, mainApp, path, connectorManager, downloadsRepository, database, configService, apiKeysRepository: authRepos.apiKeysRepository }
 }
 
 const KEY = { 'X-Management-Key': 'mgmt-secret' } as const
@@ -548,6 +550,50 @@ describe('Management API jack config', () => {
     expect(await get.json()).toEqual({ internalUrl: 'http://jack.test:5225', apiKey: { env: 'JACK_X' } })
   })
 
+  test('PATCH preserves external header refs while the service resolves them on demand', async () => {
+    process.env.CF_ACCESS_ID = 'resolved-client-id'
+    const { app, path, configService } = await makeMutableApp()
+
+    const patch = await app.request('/config/jack', {
+      method: 'PATCH',
+      headers: { ...KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        internalUrl: 'http://jack.test:5225',
+        external: {
+          instanceName: 'Roz’s Jack',
+          url: 'https://jack.example.com',
+          headers: {
+            'CF-Access-Client-Id': { env: 'CF_ACCESS_ID' },
+            'CF-Access-Client-Secret': 'literal-secret',
+          },
+          ignored: true,
+        },
+      }),
+    })
+    expect(patch.status).toBe(200)
+
+    const onDisk = jsonc.parse(await Bun.file(path).text()) as { jack: { external: unknown } }
+    expect(onDisk.jack.external).toEqual({
+      instanceName: 'Roz’s Jack',
+      url: 'https://jack.example.com',
+      headers: {
+        'CF-Access-Client-Id': { env: 'CF_ACCESS_ID' },
+        'CF-Access-Client-Secret': 'literal-secret',
+      },
+    })
+
+    const get = await app.request('/config/jack', { headers: KEY })
+    expect((await get.json() as any).external.headers['CF-Access-Client-Id']).toEqual({ env: 'CF_ACCESS_ID' })
+    expect(configService.getResolvedExternalJack()).toEqual({
+      instanceName: 'Roz’s Jack',
+      url: 'https://jack.example.com',
+      headers: {
+        'CF-Access-Client-Id': 'resolved-client-id',
+        'CF-Access-Client-Secret': 'literal-secret',
+      },
+    })
+  })
+
   test('PATCH with no apiKey persists a jack block without one (optional)', async () => {
     const { app, path } = await makeMutableApp()
 
@@ -585,6 +631,186 @@ describe('Management API jack config', () => {
     })
     expect(res.status).toBe(404)
   })
+
+  test('PATCH /config/jack/external updates only external config during a concurrent Jack save', async () => {
+    const { app } = await makeMutableApp()
+    await app.request('/config/jack', {
+      method: 'PATCH',
+      headers: { ...KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        internalUrl: 'http://jack.test:5225',
+        external: { instanceName: 'Old name', url: 'https://old.example.com' },
+      }),
+    })
+
+    const [jackPatch, externalPatch] = await Promise.all([
+      app.request('/config/jack', {
+        method: 'PATCH',
+        headers: { ...KEY, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ internalUrl: 'http://jack-new.test:5225' }),
+      }),
+      app.request('/config/jack/external', {
+        method: 'PATCH',
+        headers: { ...KEY, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ instanceName: 'Roz’s Jack', url: 'https://jack.example.com' }),
+      }),
+    ])
+
+    expect(jackPatch.status).toBe(200)
+    expect(externalPatch.status).toBe(200)
+    const get = await app.request('/config/jack', { headers: KEY })
+    expect(await get.json()).toMatchObject({
+      internalUrl: 'http://jack-new.test:5225',
+      external: { instanceName: 'Roz’s Jack', url: 'https://jack.example.com' },
+    })
+  })
+
+  test('DELETE /config/jack/external removes external config only', async () => {
+    const { app } = await makeMutableApp()
+    await app.request('/config/jack', {
+      method: 'PATCH',
+      headers: { ...KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        internalUrl: 'http://jack.test:5225',
+        external: { instanceName: 'Roz’s Jack', url: 'https://jack.example.com' },
+      }),
+    })
+
+    const remove = await app.request('/config/jack/external', {
+      method: 'DELETE',
+      headers: KEY,
+    })
+    expect(remove.status).toBe(200)
+
+    const get = await app.request('/config/jack', { headers: KEY })
+    const body = await get.json() as Record<string, unknown>
+    expect(body.internalUrl).toBe('http://jack.test:5225')
+    expect(body.external).toBeUndefined()
+  })
+})
+
+describe('Management API quick links', () => {
+  test('POST /quick-links returns a ready-to-share link with resolved headers and a fresh key', async () => {
+    process.env.CF_ACCESS_ID = 'resolved-client-id'
+    const { app, apiKeysRepository } = await makeMutableApp()
+
+    await app.request('/config/jack', {
+      method: 'PATCH',
+      headers: { ...KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        internalUrl: 'http://jack.test:5225',
+        external: {
+          instanceName: 'Roz’s Jack',
+          url: 'https://jack.example.com',
+          headers: { 'CF-Access-Client-Id': { env: 'CF_ACCESS_ID' } },
+        },
+      }),
+    })
+
+    const res = await app.request('/quick-links', {
+      method: 'POST',
+      headers: { ...KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        peerName: 'Roz’s Jack',
+        keyName: 'Friend access',
+        keyDescription: 'Shared with a friend',
+      }),
+    })
+
+    expect(res.status).toBe(201)
+    expect(res.headers.get('Cache-Control')).toBe('no-store')
+    const body = await res.json() as { link: string, key: Record<string, unknown> }
+    expect(body.link.startsWith('jack-link:v1:')).toBe(true)
+    expect(body.key).not.toHaveProperty('key')
+    expect(body.key).toMatchObject({ name: 'Friend access', description: 'Shared with a friend' })
+
+    const encoded = body.link.slice('jack-link:v1:'.length)
+    const payload = JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8')) as {
+      v: number
+      type: string
+      name: string
+      url: string
+      apiKey: string
+      headers: Record<string, string>
+    }
+    expect(payload).toEqual({
+      v: 1,
+      type: 'peer',
+      name: 'Roz’s Jack',
+      url: 'https://jack.example.com',
+      apiKey: expect.any(String),
+      headers: { 'CF-Access-Client-Id': 'resolved-client-id' },
+    })
+    expect(apiKeysRepository.resolve(payload.apiKey).status).toBe('ok')
+  })
+
+  test('does not create an API key when the external profile is missing', async () => {
+    const { app, apiKeysRepository } = await makeMutableApp()
+    const res = await app.request('/quick-links', {
+      method: 'POST',
+      headers: { ...KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ peerName: 'Friend Jack', keyName: 'Friend access' }),
+    })
+
+    expect(res.status).toBe(400)
+    expect(apiKeysRepository.list()).toHaveLength(0)
+  })
+
+  test('does not create an API key when an external secret can no longer resolve', async () => {
+    process.env.TEMP_EXTERNAL_HEADER = 'available-while-saving'
+    const { app, apiKeysRepository } = await makeMutableApp()
+    await app.request('/config/jack', {
+      method: 'PATCH',
+      headers: { ...KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        internalUrl: 'http://jack.test:5225',
+        external: {
+          url: 'https://jack.example.com',
+          headers: { Authorization: { env: 'TEMP_EXTERNAL_HEADER' } },
+        },
+      }),
+    })
+    delete process.env.TEMP_EXTERNAL_HEADER
+
+    const res = await app.request('/quick-links', {
+      method: 'POST',
+      headers: { ...KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ peerName: 'Friend Jack', keyName: 'Friend access' }),
+    })
+
+    expect(res.status).toBe(400)
+    expect(apiKeysRepository.list()).toHaveLength(0)
+  })
+
+  test('revokes the fresh API key when the generated link exceeds the import limit', async () => {
+    const { app, apiKeysRepository } = await makeMutableApp()
+    await app.request('/config/jack', {
+      method: 'PATCH',
+      headers: { ...KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        internalUrl: 'http://jack.test:5225',
+        external: {
+          url: 'https://jack.example.com',
+          headers: { Authorization: 'x'.repeat(30_000) },
+        },
+      }),
+    })
+
+    const res = await app.request('/quick-links', {
+      method: 'POST',
+      headers: { ...KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ peerName: 'Friend Jack', keyName: 'Friend access' }),
+    })
+
+    expect(res.status).toBe(400)
+    expect(apiKeysRepository.list()).toHaveLength(0)
+  })
+
+  test('the public app never exposes /quick-links', async () => {
+    const { mainApp } = await makeMutableApp()
+    const res = await mainApp.request('/quick-links', { method: 'POST', headers: { 'x-api-key': 'test-api-key' } })
+    expect(res.status).toBe(404)
+  })
 })
 
 describe('Management API downloads config', () => {
diff --git a/apps/backend/src/__tests__/config.test.ts b/apps/backend/src/__tests__/config.test.ts
index f8fd43b..aff265c 100644
--- a/apps/backend/src/__tests__/config.test.ts
+++ b/apps/backend/src/__tests__/config.test.ts
@@ -3,7 +3,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
 import z from 'zod'
-import { ConfigSecret, migrateConfig, MIGRATIONS } from '../lib/config'
+import { ConfigSecret, ExternalJackConfig, migrateConfig, MIGRATIONS, RawExternalJackConfig } from '../lib/config'
 
 const HEX_KEY = '0123456789abcdef0123456789abcdef'
 
@@ -94,6 +94,99 @@ describe('configSecret', () => {
   })
 })
 
+describe('external Jack config', () => {
+  const savedEnv = { ...process.env }
+
+  beforeEach(() => {
+    process.env.CF_ACCESS_ID = 'resolved-client-id'
+  })
+
+  afterEach(() => {
+    process.env = { ...savedEnv }
+  })
+
+  test('resolves ConfigSecret headers for quick-link generation', () => {
+    expect(ExternalJackConfig.parse({
+      instanceName: 'Roz’s Jack',
+      url: 'https://jack.example.com',
+      headers: {
+        'CF-Access-Client-Id': { env: 'CF_ACCESS_ID' },
+        'CF-Access-Client-Secret': 'literal-secret',
+      },
+    })).toEqual({
+      instanceName: 'Roz’s Jack',
+      url: 'https://jack.example.com',
+      headers: {
+        'CF-Access-Client-Id': 'resolved-client-id',
+        'CF-Access-Client-Secret': 'literal-secret',
+      },
+    })
+  })
+
+  test('preserves ConfigSecret refs in the raw schema', () => {
+    expect(RawExternalJackConfig.parse({
+      instanceName: 'Roz’s Jack',
+      url: 'https://jack.example.com',
+      headers: { 'CF-Access-Client-Id': { env: 'CF_ACCESS_ID' } },
+      ignored: true,
+    })).toEqual({
+      instanceName: 'Roz’s Jack',
+      url: 'https://jack.example.com',
+      headers: { 'CF-Access-Client-Id': { env: 'CF_ACCESS_ID' } },
+    })
+  })
+
+  test.each(['X-Api-Key', 'Host', 'Content-Length', 'Connection', 'Transfer-Encoding'])(
+    'rejects the reserved header %s',
+    (header) => {
+      expect(RawExternalJackConfig.safeParse({
+        url: 'https://jack.example.com',
+        headers: { [header]: 'unsafe' },
+      }).success).toBe(false)
+    },
+  )
+
+  test('rejects non-HTTP external URLs', () => {
+    expect(RawExternalJackConfig.safeParse({ url: 'file:///etc/passwd' }).success).toBe(false)
+  })
+
+  test.each([
+    'https://user@jack.example.com',
+    'https://user:password@jack.example.com',
+  ])('rejects external URLs containing userinfo credentials: %s', (url) => {
+    expect(ExternalJackConfig.safeParse({ url }).success).toBe(false)
+    expect(RawExternalJackConfig.safeParse({ url }).success).toBe(false)
+  })
+
+  test('rejects external header values containing line breaks', () => {
+    expect(ExternalJackConfig.safeParse({
+      url: 'https://jack.example.com',
+      headers: { Authorization: 'safe\r\nInjected: value' },
+    }).success).toBe(false)
+  })
+
+  test.each(['constructor', 'prototype', '__proto__'])(
+    'rejects the dangerous external header name %s',
+    (header) => {
+      const headers = Object.create(null) as Record<string, string>
+      headers[header] = 'value'
+      expect(ExternalJackConfig.safeParse({ url: 'https://jack.example.com', headers }).success).toBe(false)
+    },
+  )
+
+  test('rejects more headers than the quick-link decoder accepts', () => {
+    const headers = Object.fromEntries(Array.from({ length: 101 }, (_, index) => [`X-Test-${index}`, 'value']))
+    expect(ExternalJackConfig.safeParse({ url: 'https://jack.example.com', headers }).success).toBe(false)
+    expect(RawExternalJackConfig.safeParse({ url: 'https://jack.example.com', headers }).success).toBe(false)
+  })
+
+  test('rejects case-insensitive duplicate external header names', () => {
+    const headers = { Authorization: 'first', authorization: 'second' }
+    expect(ExternalJackConfig.safeParse({ url: 'https://jack.example.com', headers }).success).toBe(false)
+    expect(RawExternalJackConfig.safeParse({ url: 'https://jack.example.com', headers }).success).toBe(false)
+  })
+})
+
 describe('migrateConfig', () => {
   test('migrates a versionless config up to the latest version', () => {
     const result = migrateConfig({ servers: [], peers: [] })
diff --git a/apps/backend/src/lib/config.ts b/apps/backend/src/lib/config.ts
index 2235bfc..1017d58 100644
--- a/apps/backend/src/lib/config.ts
+++ b/apps/backend/src/lib/config.ts
@@ -149,6 +149,73 @@ export const RawPeerConfig = z.object({
 
 export type RawPeerConfig = z.infer<typeof RawPeerConfig>
 
+const RESERVED_EXTERNAL_HEADERS = new Set([
+  'x-api-key',
+  'host',
+  'content-length',
+  'connection',
+  'transfer-encoding',
+])
+const DANGEROUS_EXTERNAL_HEADER_NAMES = new Set(['__proto__', 'prototype', 'constructor'])
+const HTTP_HEADER_LINE_BREAK = /[\r\n]/
+
+const ExternalHeaderName = z.string()
+  .trim()
+  .min(1)
+  .regex(/^[!#$%&'*+\-.^`|~\w]+$/, 'Invalid HTTP header name')
+  .refine(name => !DANGEROUS_EXTERNAL_HEADER_NAMES.has(name.toLowerCase()), 'Dangerous HTTP header name')
+  .refine(name => !RESERVED_EXTERNAL_HEADERS.has(name.toLowerCase()), 'Reserved HTTP header')
+
+const ExternalHeaderValue = z.string()
+  .min(1)
+  .refine(value => !HTTP_HEADER_LINE_BREAK.test(value), 'HTTP header values cannot contain line breaks')
+
+const ExternalJackUrl = z.url().refine((value) => {
+  const url = new URL(value)
+  return (url.protocol === 'http:' || url.protocol === 'https:')
+    && !url.username
+    && !url.password
+}, 'External URL must use HTTP or HTTPS and cannot contain userinfo credentials')
+
+// Inspect raw keys before z.record builds its output object. In particular,
+// assigning `__proto__` onto a normal object can otherwise mutate its prototype
+// instead of surviving as an own key for the key schema to validate.
+const ExternalHeadersObject = z.unknown().superRefine((headers, ctx) => {
+  if (typeof headers !== 'object' || headers === null || Array.isArray(headers))
+    return
+  const normalizedNames = new Set<string>()
+  for (const name of Object.keys(headers)) {
+    const normalizedName = name.toLowerCase()
+    if (DANGEROUS_EXTERNAL_HEADER_NAMES.has(normalizedName))
+      ctx.addIssue({ code: 'custom', message: 'Dangerous HTTP header name' })
+    if (normalizedNames.has(normalizedName))
+      ctx.addIssue({ code: 'custom', message: 'Duplicate HTTP header name' })
+    normalizedNames.add(normalizedName)
+  }
+})
+
+const ResolvedExternalHeaders = ExternalHeadersObject.pipe(z.record(ExternalHeaderName, ConfigSecret(ExternalHeaderValue)))
+  .refine(headers => Object.keys(headers).length <= 100, 'At most 100 external headers are allowed')
+
+const RawExternalHeaders = ExternalHeadersObject.pipe(z.record(ExternalHeaderName, RawConfigSecret))
+  .refine(headers => Object.keys(headers).length <= 100, 'At most 100 external headers are allowed')
+
+export const ExternalJackConfig = z.object({
+  instanceName: z.string().trim().min(1).max(100).optional(),
+  url: ExternalJackUrl,
+  headers: ResolvedExternalHeaders.default({}),
+})
+
+export type ExternalJackConfig = z.infer<typeof ExternalJackConfig>
+
+export const RawExternalJackConfig = z.object({
+  instanceName: z.string().trim().min(1).max(100).optional(),
+  url: ExternalJackUrl,
+  headers: RawExternalHeaders.optional(),
+})
+
+export type RawExternalJackConfig = z.infer<typeof RawExternalJackConfig>
+
 export const JackConfig = z.object({
   internalUrl: z.url(),
   // The single "Main API key" (deprecated). Optional: a jack block can carry
@@ -157,6 +224,9 @@ export const JackConfig = z.object({
   apiKey: ConfigSecret().optional(),
   // Optional TMDB v3 API key for enriching peer catalogs with artwork/metadata.
   tmdbApiKey: ConfigSecret().optional(),
+  // How another Jack reaches this instance. Header secrets resolve only when a
+  // quick link is generated; raw refs remain intact in the persisted config.
+  external: ExternalJackConfig.optional(),
 })
 
 export type JackConfig = z.infer<typeof JackConfig>
@@ -167,6 +237,7 @@ export const RawJackConfig = z.object({
   internalUrl: z.url(),
   apiKey: RawConfigSecret.optional(),
   tmdbApiKey: RawConfigSecret.optional(),
+  external: RawExternalJackConfig.optional(),
 })
 
 export type RawJackConfig = z.infer<typeof RawJackConfig>
diff --git a/apps/backend/src/lib/servers/arr/arr-add-import.test.ts b/apps/backend/src/lib/servers/arr/arr-add-import.test.ts
index 96215fb..424b240 100644
--- a/apps/backend/src/lib/servers/arr/arr-add-import.test.ts
+++ b/apps/backend/src/lib/servers/arr/arr-add-import.test.ts
@@ -135,13 +135,17 @@ describe('RadarrServerConnector.add', () => {
 })
 
 describe('RadarrServerConnector.manualImport', () => {
-  test('imports only the file matching params.paths, carrying movieId/downloadId/quality/languages', async () => {
+  test('discovers candidates without movieId and imports only the file matching params.paths', async () => {
     let commandBody: unknown = null
+    const manualImportUrls: string[] = []
     server.use(
-      http.get(`${RADARR_URL}/api/v3/manualimport`, () => HttpResponse.json([
-        { path: '/downloads/Movie.mkv', quality: { quality: { id: 7 } }, languages: [{ id: 1, name: 'English' }], releaseGroup: 'GRP' },
-        { path: '/downloads/Other.mkv', quality: { quality: { id: 3 } }, languages: [{ id: 2, name: 'French' }], releaseGroup: 'X' },
-      ])),
+      http.get(`${RADARR_URL}/api/v3/manualimport`, ({ request }) => {
+        manualImportUrls.push(request.url)
+        return HttpResponse.json([
+          { path: '/downloads/Movie.mkv', quality: { quality: { id: 7 } }, languages: [{ id: 1, name: 'English' }], releaseGroup: 'GRP' },
+          { path: '/downloads/Other.mkv', quality: { quality: { id: 3 } }, languages: [{ id: 2, name: 'French' }], releaseGroup: 'X' },
+        ])
+      }),
       http.post(`${RADARR_URL}/api/v3/command`, async ({ request }) => {
         commandBody = await request.json()
         return HttpResponse.json({ id: 1 })
@@ -157,6 +161,12 @@ describe('RadarrServerConnector.manualImport', () => {
     })
 
     const body = CommandBody.parse(commandBody)
+    const manualImportQuery = new URL(manualImportUrls[0]!).searchParams
+    // Radarr ignores `folder` when movieId is set, scanning the (not yet existing)
+    // library folder instead of the download folder.
+    expect(manualImportQuery.get('movieId')).toBeNull()
+    expect(manualImportQuery.get('folder')).toBe('/downloads')
+    expect(manualImportQuery.get('filterExistingFiles')).toBe('false')
     expect(commandId).toBe(1)
     expect(body.name).toBe('ManualImport')
     expect(body.importMode).toBe('move')
diff --git a/apps/backend/src/lib/servers/arr/radarr.ts b/apps/backend/src/lib/servers/arr/radarr.ts
index 63876df..e83c785 100644
--- a/apps/backend/src/lib/servers/arr/radarr.ts
+++ b/apps/backend/src/lib/servers/arr/radarr.ts
@@ -200,9 +200,13 @@ export class RadarrServerConnector extends ArrServerConnector {
       throw new BadRequestError(`Radarr cannot import a "${params.target.kind}" target`)
     const { movieId } = params.target
 
+    // No movieId here: Radarr's controller short-circuits on it and lists the files
+    // already in the movie's library folder, ignoring `folder` entirely (and blowing
+    // up with DirectoryNotFoundException when that folder doesn't exist yet, which is
+    // always the case before a first import). The movieId belongs on the command
+    // payload below, which is what actually maps the files to the movie.
     const candidates = await this.arrGet<ManualImportCandidate[]>('/api/v3/manualimport', {
       folder: params.folder,
-      movieId: String(movieId),
       filterExistingFiles: 'false',
     })
     const wanted = new Set(params.paths)
diff --git a/apps/backend/src/management-app.ts b/apps/backend/src/management-app.ts
index 26258b4..5bde92e 100644
--- a/apps/backend/src/management-app.ts
+++ b/apps/backend/src/management-app.ts
@@ -23,6 +23,8 @@ import { getDownloadsManagementRouter } from './modules/downloads/downloads.rout
 import { logHub } from './modules/logging/log-store'
 import { LogsController } from './modules/logging/logs.controller'
 import { getLogsRouter } from './modules/logging/logs.router'
+import { QuickLinksController } from './modules/quick-links/quick-links.controller'
+import { getQuickLinksRouter } from './modules/quick-links/quick-links.router'
 import { StatusController } from './modules/status/status.controller'
 import { getStatusRouter } from './modules/status/status.router'
 
@@ -85,6 +87,9 @@ export function getManagementApp(params: {
   if (params.apiKeysRepository) {
     const apiKeysController = new ApiKeysController(params.apiKeysRepository)
     app.route('/api-keys', getApiKeysRouter(apiKeysController))
+
+    if (params.configService)
+      app.route('/quick-links', getQuickLinksRouter(new QuickLinksController(params.configService, apiKeysController)))
   }
 
   // The management API is key-guarded and serves the admin UI, so it exposes
diff --git a/apps/backend/src/modules/config/config.controller.ts b/apps/backend/src/modules/config/config.controller.ts
index 39c1e27..0606370 100644
--- a/apps/backend/src/modules/config/config.controller.ts
+++ b/apps/backend/src/modules/config/config.controller.ts
@@ -134,6 +134,10 @@ export class ConfigController {
     return this.mutate(s => s.updateJack(input))
   }
 
+  updateJackExternal(input: unknown) {
+    return this.mutate(s => s.updateJackExternal(input))
+  }
+
   updateDownloads(input: unknown) {
     return this.mutate(s => s.updateDownloads(input))
   }
diff --git a/apps/backend/src/modules/config/config.router.ts b/apps/backend/src/modules/config/config.router.ts
index 84ad601..a63780d 100644
--- a/apps/backend/src/modules/config/config.router.ts
+++ b/apps/backend/src/modules/config/config.router.ts
@@ -2,7 +2,7 @@ import type { ConfigController } from './config.controller'
 import { Hono } from 'hono'
 import { describeRoute, validator as zValidator } from 'hono-openapi'
 import { z } from 'zod'
-import { RawDownloadsConfig, RawJackConfig, RawPeerConfig, RawServerConfig } from '../../lib/config'
+import { RawDownloadsConfig, RawExternalJackConfig, RawJackConfig, RawPeerConfig, RawServerConfig } from '../../lib/config'
 import { streamSnapshots } from '../../lib/sse'
 
 const idParam = z.object({ id: z.string().min(1) })
@@ -70,6 +70,14 @@ export function getConfigRouter(controller: ConfigController) {
       return c.json(await controller.updateJack(c.req.valid('json')))
     })
 
+    app.patch('/jack/external', configDoc('Update external Jack access', 'Atomically replaces only the external access profile.'), zValidator('json', RawExternalJackConfig), async (c) => {
+      return c.json(await controller.updateJackExternal(c.req.valid('json')))
+    })
+
+    app.delete('/jack/external', configDoc('Remove external Jack access', 'Atomically removes only the external access profile.'), async (c) => {
+      return c.json(await controller.updateJackExternal(null))
+    })
+
     // Partial patch: the body is merged onto the stored downloads block. Every knob
     // but `unlinkImportedFiles` is captured at boot, so those land on next restart.
     app.patch('/downloads', configDoc('Update the downloads block', 'Merges the given fields into the stored downloads config. `unlinkImportedFiles` applies immediately; the other values take effect on next boot.'), zValidator('json', RawDownloadsConfig), async (c) => {
diff --git a/apps/backend/src/modules/config/config.service.ts b/apps/backend/src/modules/config/config.service.ts
index d7772b5..e8548ea 100644
--- a/apps/backend/src/modules/config/config.service.ts
+++ b/apps/backend/src/modules/config/config.service.ts
@@ -4,7 +4,8 @@ import type { ConnectorManager } from '../../lib/servers'
 import type { DownloadsRepository } from '../downloads/downloads.repository'
 import { jsonc } from 'jsonc'
 import { atomicWriteFile } from '../../lib/atomic-write'
-import { DownloadsConfig, JackConfig, PeerConfig, RawDownloadsConfig, RawJackConfig, RawPeerConfig, RawServerConfig, ServerConfig } from '../../lib/config'
+import { DownloadsConfig, ExternalJackConfig, JackConfig, PeerConfig, RawDownloadsConfig, RawExternalJackConfig, RawJackConfig, RawPeerConfig, RawServerConfig, ServerConfig } from '../../lib/config'
+import { BadRequestError } from '../../lib/errors/BadRequestError'
 import { ConflictError } from '../../lib/errors/ConflictError'
 import { NotFoundError } from '../../lib/errors/NotFoundError'
 import { generateId } from '../../lib/servers/base'
@@ -108,6 +109,14 @@ export class ConfigService {
     return RawJackConfig.parse(jack)
   }
 
+  /** Resolve the saved external access profile only when a quick link needs it. */
+  getResolvedExternalJack(): ExternalJackConfig | null {
+    const external = this.raw.jack?.external
+    if (!external)
+      return null
+    return ExternalJackConfig.parse(external)
+  }
+
   /**
    * The persisted `downloads` block, or null when the file has none (downloads are
    * disabled). Read straight from the file — no secrets live in this block — so the
@@ -292,7 +301,34 @@ export class ConfigService {
     JackConfig.parse(input)
     const rawJack = RawJackConfig.parse(input)
     return this.enqueue(async () => {
-      const next = { ...this.raw, jack: rawJack } as RawConfig
+      const merged = {
+        ...rawJack,
+        ...(!Object.hasOwn(rawJack, 'external') && this.raw.jack?.external
+          ? { external: this.raw.jack.external }
+          : {}),
+      }
+      JackConfig.parse(merged)
+      const next = { ...this.raw, jack: RawJackConfig.parse(merged) } as RawConfig
+      await this.persist(next)
+      this.raw = next
+    })
+  }
+
+  /** Atomically replace or remove only jack.external, preserving every sibling field. */
+  async updateJackExternal(input: unknown): Promise<void> {
+    const rawExternal = input === null ? null : RawExternalJackConfig.parse(input)
+    if (rawExternal)
+      ExternalJackConfig.parse(rawExternal)
+
+    return this.enqueue(async () => {
+      const current = this.raw.jack
+      if (!current)
+        throw new BadRequestError('Configure Jack before setting up quick linking')
+
+      const { external: _external, ...jackWithoutExternal } = current
+      const merged = rawExternal ? { ...jackWithoutExternal, external: rawExternal } : jackWithoutExternal
+      JackConfig.parse(merged)
+      const next = { ...this.raw, jack: RawJackConfig.parse(merged) } as RawConfig
       await this.persist(next)
       this.raw = next
     })
diff --git a/apps/backend/src/modules/quick-links/quick-links.controller.ts b/apps/backend/src/modules/quick-links/quick-links.controller.ts
new file mode 100644
index 0000000..e29f2a0
--- /dev/null
+++ b/apps/backend/src/modules/quick-links/quick-links.controller.ts
@@ -0,0 +1,77 @@
+import type { ApiKeyResponse, ApiKeysController } from '../api-keys/api-keys.controller'
+import type { ConfigService } from '../config/config.service'
+import type { CreateQuickLinkBody } from './quick-links.schema'
+import { Buffer } from 'node:buffer'
+import { z } from 'zod'
+import { BadRequestError } from '../../lib/errors/BadRequestError'
+
+export interface QuickLinkPayload {
+  v: 1
+  type: 'peer'
+  name: string
+  url: string
+  apiKey: string
+  headers: Record<string, string>
+}
+
+export interface CreateQuickLinkResponse {
+  link: string
+  key: ApiKeyResponse
+}
+
+export function encodeQuickLink(payload: QuickLinkPayload): string {
+  const link = `jack-link:v1:${Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url')}`
+  if (link.length > 32_768)
+    throw new BadRequestError('The configured external access profile is too large for a quick link')
+  return link
+}
+
+export class QuickLinksController {
+  constructor(
+    private readonly configService: ConfigService,
+    private readonly apiKeysController: ApiKeysController,
+  ) {}
+
+  create(input: CreateQuickLinkBody): CreateQuickLinkResponse {
+    // Resolve every ConfigSecret before issuing a credential. A broken or missing
+    // external profile therefore cannot leave an orphan API key behind.
+    let external
+    try {
+      external = this.configService.getResolvedExternalJack()
+    }
+    catch (error) {
+      if (error instanceof z.ZodError)
+        throw new BadRequestError('The external access profile contains a secret that could not be resolved')
+      throw error
+    }
+    if (!external)
+      throw new BadRequestError('Configure Jack external access before generating a quick link')
+
+    const created = this.apiKeysController.create({
+      name: input.keyName,
+      description: input.keyDescription,
+      expiresAt: input.expiresAt,
+    })
+    const { key: rawKey, ...key } = created
+
+    try {
+      return {
+        link: encodeQuickLink({
+          v: 1,
+          type: 'peer',
+          name: input.peerName,
+          url: external.url,
+          apiKey: rawKey,
+          headers: external.headers,
+        }),
+        key,
+      }
+    }
+    catch (error) {
+      // Encoding should be infallible for the validated string-only payload, but
+      // compensate if that contract changes so a credential is never orphaned.
+      this.apiKeysController.delete(created.id)
+      throw error
+    }
+  }
+}
diff --git a/apps/backend/src/modules/quick-links/quick-links.router.ts b/apps/backend/src/modules/quick-links/quick-links.router.ts
new file mode 100644
index 0000000..d067fb5
--- /dev/null
+++ b/apps/backend/src/modules/quick-links/quick-links.router.ts
@@ -0,0 +1,22 @@
+import type { QuickLinksController } from './quick-links.controller'
+import { Hono } from 'hono'
+import { describeRoute, validator as zValidator } from 'hono-openapi'
+import { CreateQuickLinkBody } from './quick-links.schema'
+
+export function getQuickLinksRouter(controller: QuickLinksController) {
+  const app = new Hono()
+
+  app.post('/', describeRoute({
+    tags: ['Quick links'],
+    summary: 'Generate a peer quick link',
+    description: 'Resolves the configured external access profile, issues a fresh revocable API key, and returns a ready-to-share quick link. The link contains credentials and is returned only once.',
+    security: [{ 'X-Management-Key': [] }],
+    responses: { 201: { description: 'Quick link generated', content: { 'application/json': {} } } },
+  }), zValidator('json', CreateQuickLinkBody), (c) => {
+    const result = controller.create(c.req.valid('json'))
+    c.header('Cache-Control', 'no-store')
+    return c.json(result, 201)
+  })
+
+  return app
+}
diff --git a/apps/backend/src/modules/quick-links/quick-links.schema.ts b/apps/backend/src/modules/quick-links/quick-links.schema.ts
new file mode 100644
index 0000000..f80d98c
--- /dev/null
+++ b/apps/backend/src/modules/quick-links/quick-links.schema.ts
@@ -0,0 +1,10 @@
+import z from 'zod'
+
+export const CreateQuickLinkBody = z.object({
+  peerName: z.string().trim().min(1).max(100),
+  keyName: z.string().trim().min(1).max(100),
+  keyDescription: z.string().max(500).nullish(),
+  expiresAt: z.string().datetime().nullish(),
+})
+
+export type CreateQuickLinkBody = z.infer<typeof CreateQuickLinkBody>
diff --git a/apps/ui/app/components/JackConfigForm.vue b/apps/ui/app/components/JackConfigForm.vue
index 65b978f..9ef4ed2 100644
--- a/apps/ui/app/components/JackConfigForm.vue
+++ b/apps/ui/app/components/JackConfigForm.vue
@@ -19,9 +19,10 @@ const state = reactive({
 
 // internalUrl is the only required field; the Main API key is optional/clearable.
 function validate(s: typeof state): FormError[] {
+  const errors: FormError[] = []
   if (!s.internalUrl.trim())
-    return [{ name: 'internalUrl', message: 'Enter the internal URL.' }]
-  return []
+    errors.push({ name: 'internalUrl', message: 'Enter the internal URL.' })
+  return errors
 }
 
 function onSubmit() {
diff --git a/apps/ui/app/components/PeerForm.vue b/apps/ui/app/components/PeerForm.vue
index a2a2900..a9e2745 100644
--- a/apps/ui/app/components/PeerForm.vue
+++ b/apps/ui/app/components/PeerForm.vue
@@ -3,13 +3,13 @@ import type { FormError } from '@nuxt/ui'
 import type { PeerInput, PeerItem, SecretRef } from '~/types/management'
 
 const props = defineProps<{
-  initial?: PeerItem | null
+  initial?: PeerItem | PeerInput | null
   submitting?: boolean
   error?: string | null
 }>()
 const emit = defineEmits<{ submit: [PeerInput, boolean], cancel: [] }>()
 
-const editing = computed(() => Boolean(props.initial))
+const editing = computed(() => Boolean(props.initial && 'id' in props.initial))
 
 const state = reactive({
   name: props.initial?.name ?? '',
diff --git a/apps/ui/app/components/PeersSection.vue b/apps/ui/app/components/PeersSection.vue
index d49beef..69b9fca 100644
--- a/apps/ui/app/components/PeersSection.vue
+++ b/apps/ui/app/components/PeersSection.vue
@@ -7,8 +7,17 @@ const { settings, pending, error, reload } = useSettings()
 
 const showForm = ref(false)
 const editTarget = ref<PeerItem | null>(null)
+const importedInput = ref<PeerInput | null>(null)
+const formRevision = ref(0)
+const formInitial = computed(() => editTarget.value ?? importedInput.value)
 const submitting = ref(false)
 const formError = ref<string | null>(null)
+watch(showForm, (isOpen) => {
+  if (!isOpen) {
+    importedInput.value = null
+    formError.value = null
+  }
+})
 
 const confirmTarget = ref<PeerItem | null>(null)
 const deleting = ref(false)
@@ -50,14 +59,30 @@ function closeConfirm() {
 
 function openAdd() {
   editTarget.value = null
+  importedInput.value = null
   formError.value = null
+  formRevision.value++
   showForm.value = true
 }
 function openEdit(peer: PeerItem) {
   editTarget.value = peer
+  importedInput.value = null
   formError.value = null
+  formRevision.value++
   showForm.value = true
 }
+function reviewImported(peer: PeerInput) {
+  editTarget.value = null
+  importedInput.value = peer
+  formError.value = null
+  formRevision.value++
+  showForm.value = true
+}
+defineExpose({ reviewImported })
+function closeForm() {
+  showForm.value = false
+  importedInput.value = null
+}
 
 async function submit(input: PeerInput, force = false) {
   submitting.value = true
@@ -70,7 +95,7 @@ async function submit(input: PeerInput, force = false) {
       await request(`config/peers/${editTarget.value.id}`, { method: 'PATCH', body: input, query })
     else
       await request('config/peers', { method: 'POST', body: input, query })
-    showForm.value = false
+    closeForm()
     await reload()
   }
   catch (err) {
@@ -154,11 +179,12 @@ async function confirmDelete() {
   <UModal v-model:open="showForm" :title="editTarget ? 'Edit peer' : 'Add peer'">
     <template #body>
       <PeerForm
-        :initial="editTarget"
+        :key="formRevision"
+        :initial="formInitial"
         :submitting="submitting"
         :error="formError"
         @submit="submit"
-        @cancel="showForm = false"
+        @cancel="closeForm"
       />
     </template>
   </UModal>
diff --git a/apps/ui/app/components/QuickLinkGenerateModal.vue b/apps/ui/app/components/QuickLinkGenerateModal.vue
new file mode 100644
index 0000000..37dda8a
--- /dev/null
+++ b/apps/ui/app/components/QuickLinkGenerateModal.vue
@@ -0,0 +1,142 @@
+<script setup lang="ts">
+import type { FormError } from '@nuxt/ui'
+import type { CreatedQuickLink, QuickLinkInput } from '~/types/management'
+import { suggestQuickLinkKeyName } from '~/utils/quick-link'
+
+const props = defineProps<{ instanceName: string }>()
+const emit = defineEmits<{ generated: [] }>()
+const open = defineModel<boolean>('open', { required: true })
+const { request, extractError } = useManagement()
+
+const generated = ref<CreatedQuickLink | null>(null)
+const generating = ref(false)
+const copied = ref(false)
+const error = ref<string | null>(null)
+const state = reactive({ peerName: '', keyName: '', keyDescription: '' })
+const modalOpen = computed({
+  get: () => open.value,
+  set: (value) => {
+    if (!value && generating.value)
+      return
+    open.value = value
+  },
+})
+
+function reset() {
+  generated.value = null
+  generating.value = false
+  copied.value = false
+  error.value = null
+  state.peerName = props.instanceName
+  state.keyName = suggestQuickLinkKeyName(props.instanceName)
+  state.keyDescription = ''
+}
+
+watch(open, (isOpen) => {
+  if (isOpen)
+    reset()
+  else
+    generated.value = null
+})
+
+function validate(s: typeof state): FormError[] {
+  const errors: FormError[] = []
+  if (!s.peerName.trim())
+    errors.push({ name: 'peerName', message: 'Give this Jack instance a name.' })
+  if (!s.keyName.trim())
+    errors.push({ name: 'keyName', message: 'Give the generated API key a name.' })
+  return errors
+}
+
+async function generate() {
+  if (generating.value)
+    return
+  generating.value = true
+  error.value = null
+  try {
+    const input: QuickLinkInput = {
+      peerName: state.peerName.trim(),
+      keyName: state.keyName.trim(),
+      keyDescription: state.keyDescription.trim() || null,
+      expiresAt: null,
+    }
+    generated.value = await request<CreatedQuickLink>('quick-links', { method: 'POST', body: input })
+    emit('generated')
+  }
+  catch (err) {
+    error.value = extractError(err, 'Could not generate the quick link.')
+  }
+  finally {
+    generating.value = false
+  }
+}
+
+async function copyLink() {
+  if (!generated.value)
+    return
+  try {
+    await navigator.clipboard.writeText(generated.value.link)
+    copied.value = true
+    setTimeout(() => (copied.value = false), 2000)
+  }
+  catch {
+    error.value = 'Could not copy the quick link. Select and copy it manually.'
+  }
+}
+
+function close() {
+  if (generating.value)
+    return
+  generated.value = null
+  open.value = false
+}
+</script>
+
+<template>
+  <UModal v-model:open="modalOpen" title="Generate quick link" :dismissible="!generating" :ui="{ footer: 'justify-end' }">
+    <template #body>
+      <div class="space-y-4">
+        <UAlert
+          color="warning"
+          variant="soft"
+          icon="i-ph-warning"
+          title="This quick link grants access to your Jack instance."
+          description="It contains credentials. Do not publish it; share it only through a secure channel."
+        />
+
+        <UForm v-if="!generated" :state="state" :validate="validate" class="space-y-4" @submit="generate">
+          <UFormField
+            name="peerName"
+            label="Suggested peer name"
+            description="Your friend can review and change this before adding the peer."
+            required
+          >
+            <UInput v-model="state.peerName" :maxlength="100" class="w-full" />
+          </UFormField>
+          <UFormField name="keyName" label="Key name" description="Used to identify and revoke this credential later." required>
+            <UInput v-model="state.keyName" :maxlength="100" placeholder="Friend access" class="w-full" />
+          </UFormField>
+          <UFormField name="keyDescription" label="Key description" hint="Optional">
+            <UTextarea v-model="state.keyDescription" :maxlength="500" :rows="2" placeholder="Who this link is for" class="w-full" />
+          </UFormField>
+          <UAlert v-if="error" color="error" variant="soft" icon="i-ph-warning" :title="error" />
+          <div class="flex justify-end gap-2 pt-2">
+            <UButton label="Cancel" color="neutral" variant="ghost" :disabled="generating" @click="close" />
+            <UButton type="submit" label="Generate link" :loading="generating" />
+          </div>
+        </UForm>
+
+        <template v-else>
+          <UFormField label="Quick link" description="Shown only in this dialog. Closing it discards the plaintext from the UI.">
+            <UTextarea :model-value="generated.link" readonly :rows="6" class="w-full font-mono text-xs" />
+          </UFormField>
+          <UAlert v-if="error" color="error" variant="soft" icon="i-ph-warning" :title="error" />
+          <div class="flex justify-end gap-2">
+            <UButton label="Close" color="neutral" variant="ghost" @click="close" />
+            <UButton :label="copied ? 'Copied' : 'Copy quick link'" :icon="copied ? 'i-ph-check' : 'i-ph-copy'" @click="copyLink" />
+          </div>
+        </template>
+      </div>
+    </template>
+  </UModal>
+</template>
diff --git a/apps/ui/app/components/QuickLinkImportModal.vue b/apps/ui/app/components/QuickLinkImportModal.vue
new file mode 100644
index 0000000..b0023e8
--- /dev/null
+++ b/apps/ui/app/components/QuickLinkImportModal.vue
@@ -0,0 +1,61 @@
+<script setup lang="ts">
+import type { FormError } from '@nuxt/ui'
+import type { PeerInput } from '~/types/management'
+import { decodeQuickLink } from '~/utils/quick-link'
+
+const emit = defineEmits<{ imported: [PeerInput] }>()
+const open = defineModel<boolean>('open', { required: true })
+const state = reactive({ link: '' })
+const error = ref<string | null>(null)
+
+watch(open, (isOpen) => {
+  if (isOpen) {
+    state.link = ''
+    error.value = null
+  }
+  else {
+    state.link = ''
+  }
+})
+
+function validate(s: typeof state): FormError[] {
+  return s.link.trim() ? [] : [{ name: 'link', message: 'Paste a Jack quick link.' }]
+}
+
+function importLink() {
+  error.value = null
+  try {
+    const peer = decodeQuickLink(state.link)
+    state.link = ''
+    open.value = false
+    emit('imported', peer)
+  }
+  catch {
+    error.value = 'This is not a valid or supported Jack quick link.'
+  }
+}
+</script>
+
+<template>
+  <UModal v-model:open="open" title="Import quick link">
+    <template #body>
+      <UForm :state="state" :validate="validate" class="space-y-4" @submit="importLink">
+        <UAlert
+          color="warning"
+          variant="soft"
+          icon="i-ph-shield-warning"
+          title="Treat quick links as credentials."
+          description="Only import one received through a channel you trust. You can review every field before the peer is saved."
+        />
+        <UFormField name="link" label="Quick link" required>
+          <UTextarea v-model="state.link" :rows="6" autocomplete="off" placeholder="jack-link:v1:…" class="w-full font-mono text-xs" />
+        </UFormField>
+        <UAlert v-if="error" color="error" variant="soft" icon="i-ph-warning" :title="error" />
+        <div class="flex justify-end gap-2 pt-2">
+          <UButton label="Cancel" color="neutral" variant="ghost" @click="() => { open = false }" />
+          <UButton type="submit" label="Review peer" icon="i-ph-arrow-right" />
+        </div>
+      </UForm>
+    </template>
+  </UModal>
+</template>
diff --git a/apps/ui/app/components/QuickLinkingSection.vue b/apps/ui/app/components/QuickLinkingSection.vue
new file mode 100644
index 0000000..a05483c
--- /dev/null
+++ b/apps/ui/app/components/QuickLinkingSection.vue
@@ -0,0 +1,133 @@
+<script setup lang="ts">
+import type { FormError } from '@nuxt/ui'
+import type { ExternalJackConfig, SecretRef } from '~/types/management'
+
+const props = defineProps<{
+  available: boolean
+  initial?: ExternalJackConfig | null
+  submitting?: boolean
+  error?: string | null
+  saved?: boolean
+}>()
+const emit = defineEmits<{
+  submit: [ExternalJackConfig]
+  generate: []
+  import: []
+  remove: []
+}>()
+
+const state = reactive({
+  instanceName: props.initial?.instanceName ?? '',
+  url: props.initial?.url ?? '',
+  headers: { ...(props.initial?.headers ?? {}) } as Record<string, SecretRef>,
+})
+
+function validate(s: typeof state): FormError[] {
+  const errors: FormError[] = []
+  if (!s.instanceName.trim())
+    errors.push({ name: 'instanceName', message: 'Enter the instance name shared with peers.' })
+  if (!s.url.trim()) {
+    errors.push({ name: 'url', message: 'Enter the external URL.' })
+  }
+  else {
+    try {
+      const url = new URL(s.url)
+      if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+        errors.push({ name: 'url', message: 'Use an HTTP or HTTPS URL without embedded credentials.' })
+    }
+    catch {
+      errors.push({ name: 'url', message: 'Enter a valid external URL.' })
+    }
+  }
+  return errors
+}
+
+function onSubmit() {
+  emit('submit', {
+    instanceName: state.instanceName.trim(),
+    url: state.url.trim(),
+    ...(Object.keys(state.headers).length ? { headers: state.headers } : {}),
+  })
+}
+</script>
+
+<template>
+  <SettingsSection
+    title="Quick linking"
+    description="Configure how this Jack is shared, generate access links, or add a peer from one."
+  >
+    <template #aside>
+      <div class="flex flex-wrap gap-2">
+        <UButton
+          label="Generate quick link"
+          icon="i-ph-link"
+          :disabled="!available || !initial?.url || !initial?.instanceName"
+          :title="initial?.url && initial?.instanceName ? 'Generate a credential-bearing quick link' : 'Save the quick-linking configuration first'"
+          @click="emit('generate')"
+        />
+        <UButton
+          label="Add via quick link"
+          color="neutral"
+          variant="outline"
+          icon="i-ph-link-simple"
+          @click="emit('import')"
+        />
+      </div>
+    </template>
+
+    <UCard v-if="!available" variant="subtle">
+      <UAlert
+        color="neutral"
+        variant="soft"
+        icon="i-ph-info"
+        title="Configure Jack first"
+        description="You can still add a peer from a quick link, but generating links requires a local Jack configuration."
+      />
+    </UCard>
+
+    <UCard v-else variant="subtle" :ui="{ body: 'space-y-4' }">
+      <UForm :state="state" :validate="validate" class="space-y-4" @submit="onSubmit">
+        <UFormField
+          name="instanceName"
+          label="Instance name"
+          description="Suggested peer name shown to people who import one of this instance’s quick links."
+          required
+        >
+          <UInput v-model="state.instanceName" placeholder="Roz’s Jack" :maxlength="100" class="w-full" />
+        </UFormField>
+
+        <UFormField
+          name="url"
+          label="External URL"
+          description="The URL another Jack should use to reach this instance."
+          required
+        >
+          <UInput v-model="state.url" placeholder="https://jack.example.com" class="w-full" />
+        </UFormField>
+
+        <UFormField label="External headers" hint="Optional">
+          <HeadersEditor v-model="state.headers" />
+          <template #help>
+            <span>Proxy credentials such as Cloudflare Access headers. Prefer environment or file refs over literal values.</span>
+          </template>
+        </UFormField>
+
+        <UAlert v-if="error" color="error" variant="soft" icon="i-ph-warning" :title="error" />
+        <UAlert v-if="saved" color="success" variant="soft" icon="i-ph-check-circle" title="Quick-linking configuration saved." />
+
+        <div class="flex justify-between gap-2 pt-2">
+          <UButton
+            v-if="initial"
+            type="button"
+            label="Remove configuration"
+            color="error"
+            variant="ghost"
+            :disabled="submitting"
+            @click="emit('remove')"
+          />
+          <UButton type="submit" :loading="submitting" :label="submitting ? 'Saving…' : 'Save'" />
+        </div>
+      </UForm>
+    </UCard>
+  </SettingsSection>
+</template>
diff --git a/apps/ui/app/pages/settings.vue b/apps/ui/app/pages/settings.vue
index 41af592..2c3297b 100644
--- a/apps/ui/app/pages/settings.vue
+++ b/apps/ui/app/pages/settings.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import type { BadgeProps } from '@nuxt/ui'
-import type { ApiKey, ApiKeyInput, CreatedApiKey, JackConfig } from '~/types/management'
+import type { ApiKey, ApiKeyInput, CreatedApiKey, ExternalJackConfig, JackConfig, PeerInput } from '~/types/management'
 
 const { request, extractError } = useManagement()
 const version = useRuntimeConfig().public.appVersion
@@ -24,6 +24,16 @@ const { data: tmdbStatus } = await useAsyncData('tmdb-status', () =>
 const jackSubmitting = ref(false)
 const jackError = ref<string | null>(null)
 const jackSaved = ref(false)
+const jackFormRevision = ref(0)
+const showQuickLink = ref(false)
+const showQuickLinkImport = ref(false)
+const quickLinkSubmitting = ref(false)
+const quickLinkError = ref<string | null>(null)
+const quickLinkSaved = ref(false)
+const quickLinkFormRevision = ref(0)
+const showRemoveQuickLinking = ref(false)
+const removingQuickLinking = ref(false)
+const peersSection = ref<{ reviewImported: (peer: PeerInput) => void } | null>(null)
 
 async function saveJack(input: JackConfig) {
   jackSubmitting.value = true
@@ -32,6 +42,7 @@ async function saveJack(input: JackConfig) {
   try {
     await request('config/jack', { method: 'PATCH', body: input })
     await refreshJack()
+    jackFormRevision.value++
     // jack values are captured at boot, so the change lands on next restart.
     jackSaved.value = true
   }
@@ -43,6 +54,50 @@ async function saveJack(input: JackConfig) {
   }
 }
 
+async function saveQuickLinking(external: ExternalJackConfig) {
+  if (!jack.value) {
+    quickLinkError.value = 'Configure Jack before setting up quick linking.'
+    return
+  }
+  quickLinkSubmitting.value = true
+  quickLinkError.value = null
+  quickLinkSaved.value = false
+  try {
+    await request('config/jack/external', { method: 'PATCH', body: external })
+    await refreshJack()
+    quickLinkFormRevision.value++
+    quickLinkSaved.value = true
+  }
+  catch (err) {
+    quickLinkError.value = extractError(err, 'Could not save the quick-linking configuration.')
+  }
+  finally {
+    quickLinkSubmitting.value = false
+  }
+}
+
+async function removeQuickLinking() {
+  removingQuickLinking.value = true
+  quickLinkError.value = null
+  quickLinkSaved.value = false
+  try {
+    await request('config/jack/external', { method: 'DELETE' })
+    await refreshJack()
+    quickLinkFormRevision.value++
+    showRemoveQuickLinking.value = false
+  }
+  catch (err) {
+    quickLinkError.value = extractError(err, 'Could not remove the quick-linking configuration.')
+  }
+  finally {
+    removingQuickLinking.value = false
+  }
+}
+
+function reviewQuickLink(peer: PeerInput) {
+  peersSection.value?.reviewImported(peer)
+}
+
 const showForm = ref(false)
 const editTarget = ref<ApiKey | null>(null)
 const submitting = ref(false)
@@ -181,10 +236,10 @@ async function confirmRevoke() {
           </p>
 
           <UCard v-else variant="subtle" :ui="{ body: 'space-y-4' }">
-            <!-- Re-key on the loaded internalUrl so the form (and SecretInput) seed
-                 their once-initialized local state from the resolved data. -->
+            <!-- Re-key after a successful refresh so the form and nested secret
+                 editors seed their local state from the latest refs-intact config. -->
             <JackConfigForm
-              :key="jack?.internalUrl ?? 'empty'"
+              :key="jackFormRevision"
               :initial="jack"
               :submitting="jackSubmitting"
               :error="jackError"
@@ -216,11 +271,27 @@ async function confirmRevoke() {
 
         <USeparator />
 
+        <QuickLinkingSection
+          v-if="!jackPending && !jackLoadError"
+          :key="quickLinkFormRevision"
+          :available="Boolean(jack)"
+          :initial="jack?.external"
+          :submitting="quickLinkSubmitting"
+          :error="quickLinkError"
+          :saved="quickLinkSaved"
+          @submit="saveQuickLinking"
+          @generate="() => { showQuickLink = true }"
+          @import="() => { showQuickLinkImport = true }"
+          @remove="() => { showRemoveQuickLinking = true }"
+        />
+
+        <USeparator />
+
         <DownloadsSection />
 
         <USeparator />
 
-        <PeersSection />
+        <PeersSection ref="peersSection" />
 
         <USeparator />
 
@@ -328,6 +399,28 @@ async function confirmRevoke() {
     </template>
   </UModal>
 
+  <QuickLinkImportModal v-model:open="showQuickLinkImport" @imported="reviewQuickLink" />
+
+  <UModal v-model:open="showRemoveQuickLinking" title="Remove quick-linking configuration" :ui="{ footer: 'justify-end' }">
+    <template #body>
+      <p class="text-sm text-default">
+        Remove the external instance name, URL, and headers? Existing generated API keys remain active until revoked.
+      </p>
+      <UAlert v-if="quickLinkError" class="mt-3" color="error" variant="soft" icon="i-ph-warning" :title="quickLinkError" />
+    </template>
+    <template #footer="{ close }">
+      <UButton label="Cancel" color="neutral" variant="ghost" @click="close" />
+      <UButton label="Remove" color="error" :loading="removingQuickLinking" @click="removeQuickLinking" />
+    </template>
+  </UModal>
+
+  <QuickLinkGenerateModal
+    v-if="jack?.external?.url"
+    v-model:open="showQuickLink"
+    :instance-name="jack.external.instanceName ?? ''"
+    @generated="refresh"
+  />
+
   <UModal v-model:open="createdOpen" title="API key created" :ui="{ footer: 'justify-end' }">
     <template #body>
       <div class="space-y-4">
diff --git a/apps/ui/app/types/management.ts b/apps/ui/app/types/management.ts
index 8a130cb..923b4f6 100644
--- a/apps/ui/app/types/management.ts
+++ b/apps/ui/app/types/management.ts
@@ -146,12 +146,18 @@ export interface ServerInput {
   autoregister?: { enable?: boolean, priority?: number }
 }
 
-// config.jack: internalUrl + the optional, deprecated single "Main API key".
-// apiKey mirrors the backend RawConfigSecret ref (or null/absent when unset).
+// config.jack: internalUrl + optional secrets and the external access profile.
+export interface ExternalJackConfig {
+  instanceName?: string
+  url: string
+  headers?: Record<string, SecretRef>
+}
+
 export interface JackConfig {
   internalUrl: string
   apiKey?: SecretRef | null
   tmdbApiKey?: SecretRef | null
+  external?: ExternalJackConfig
 }
 
 // config.downloads, exactly as persisted (null when the block is absent — downloads
@@ -198,6 +204,18 @@ export interface ApiKeyInput {
   expiresAt?: string | null
 }
 
+export interface QuickLinkInput {
+  peerName: string
+  keyName: string
+  keyDescription?: string | null
+  expiresAt?: string | null
+}
+
+export interface CreatedQuickLink {
+  link: string
+  key: ApiKey
+}
+
 // One NDJSON log line as served by GET /logs and the /logs/stream SSE. `time` is
 // epoch millis, `level` the pino numeric level, `severity` its label; anything
 // else (trace_id, request fields, …) rides along as extra keys.
diff --git a/apps/ui/app/utils/quick-link.test.ts b/apps/ui/app/utils/quick-link.test.ts
new file mode 100644
index 0000000..325a765
--- /dev/null
+++ b/apps/ui/app/utils/quick-link.test.ts
@@ -0,0 +1,73 @@
+import { describe, expect, test } from 'bun:test'
+import { decodeQuickLink, suggestQuickLinkKeyName } from './quick-link'
+
+function base64Url(text: string): string {
+  const binary = String.fromCharCode(...new TextEncoder().encode(text))
+  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '')
+}
+
+function link(payload: unknown): string {
+  return `jack-link:v1:${base64Url(JSON.stringify(payload))}`
+}
+
+const validPayload = {
+  v: 1,
+  type: 'peer',
+  name: 'Amigo’s Jack',
+  url: 'https://jack.friend.example',
+  apiKey: 'jack_test_key',
+  headers: { 'CF-Access-Client-Id': 'client-id' },
+}
+
+describe('suggestQuickLinkKeyName', () => {
+  test('keeps the generated API key name within the backend limit', () => {
+    const suggestion = suggestQuickLinkKeyName('x'.repeat(100))
+    expect(suggestion).toHaveLength(100)
+    expect(suggestion).toStartWith('Quick link for ')
+  })
+})
+
+describe('decodeQuickLink', () => {
+  test('decodes UTF-8 and returns a PeerInput', () => {
+    expect(decodeQuickLink(link(validPayload))).toEqual({
+      name: 'Amigo’s Jack',
+      url: 'https://jack.friend.example',
+      apiKey: 'jack_test_key',
+      headers: { 'CF-Access-Client-Id': 'client-id' },
+    })
+  })
+
+  test.each([
+    ['wrong prefix', 'https://jack.friend.example'],
+    ['unsupported version', link({ ...validPayload, v: 2 })],
+    ['unsupported type', link({ ...validPayload, type: 'server' })],
+    ['invalid URL scheme', link({ ...validPayload, url: 'file:///etc/passwd' })],
+    ['URL username credentials', link({ ...validPayload, url: 'https://user@jack.friend.example' })],
+    ['URL password credentials', link({ ...validPayload, url: 'https://user:password@jack.friend.example' })],
+    ['empty API key', link({ ...validPayload, apiKey: '' })],
+    ['non-string header', link({ ...validPayload, headers: { Test: 42 } })],
+    ['reserved API key header', link({ ...validPayload, headers: { 'x-api-key': 'override' } })],
+    ['hop-by-hop header', link({ ...validPayload, headers: { Connection: 'close' } })],
+    ['header value with line breaks', link({ ...validPayload, headers: { Authorization: 'safe\r\nInjected: value' } })],
+    ['case-insensitive duplicate headers', link({ ...validPayload, headers: { Authorization: 'first', authorization: 'second' } })],
+  ])('rejects %s', (_case, input) => {
+    expect(() => decodeQuickLink(input)).toThrow()
+  })
+
+  test('rejects prototype-pollution header keys', () => {
+    const encoded = base64Url('{"v":1,"type":"peer","name":"Jack","url":"https://jack.test","apiKey":"key","headers":{"__proto__":"pollute"}}')
+    expect(() => decodeQuickLink(`jack-link:v1:${encoded}`)).toThrow()
+  })
+
+  test('rejects malformed and oversized input without echoing the secret', () => {
+    const secret = 'do-not-repeat-me'
+    expect(() => decodeQuickLink(`jack-link:v1:${secret}`)).toThrow(Error)
+    try {
+      decodeQuickLink(`jack-link:v1:${secret}`)
+    }
+    catch (error) {
+      expect(String(error)).not.toContain(secret)
+    }
+    expect(() => decodeQuickLink(`jack-link:v1:${'a'.repeat(40_000)}`)).toThrow('too large')
+  })
+})
diff --git a/apps/ui/app/utils/quick-link.ts b/apps/ui/app/utils/quick-link.ts
new file mode 100644
index 0000000..016095e
--- /dev/null
+++ b/apps/ui/app/utils/quick-link.ts
@@ -0,0 +1,115 @@
+import type { PeerInput } from '~/types/management'
+
+const PREFIX = 'jack-link:v1:'
+const MAX_QUICK_LINK_LENGTH = 32_768
+const HEADER_NAME = /^[!#$%&'*+\-.^`|~\w]+$/
+const BASE64URL = /^[\w-]+$/
+const LINE_BREAK = /[\r\n]/
+const RESERVED_HEADERS = new Set([
+  'x-api-key',
+  'host',
+  'content-length',
+  'connection',
+  'transfer-encoding',
+])
+const DANGEROUS_KEYS = new Set(['__proto__', 'prototype', 'constructor'])
+
+export function suggestQuickLinkKeyName(instanceName: string): string {
+  const name = instanceName.trim()
+  return name ? `Quick link for ${name}`.slice(0, 100) : ''
+}
+
+function fail(message = 'Invalid Jack quick link'): never {
+  throw new Error(message)
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function decodeBase64Url(encoded: string): string {
+  if (!encoded || !BASE64URL.test(encoded) || encoded.length % 4 === 1)
+    return fail()
+
+  try {
+    const base64 = encoded.replaceAll('-', '+').replaceAll('_', '/').padEnd(Math.ceil(encoded.length / 4) * 4, '=')
+    const binary = atob(base64)
+    const bytes = Uint8Array.from(binary, char => char.charCodeAt(0))
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes)
+  }
+  catch {
+    return fail()
+  }
+}
+
+function parseHeaders(value: unknown): Record<string, string> {
+  if (!isRecord(value))
+    return fail()
+
+  const entries = Object.entries(value)
+  if (entries.length > 100)
+    return fail()
+
+  const headers: Record<string, string> = Object.create(null)
+  const normalizedNames = new Set<string>()
+  for (const [name, headerValue] of entries) {
+    const lower = name.toLowerCase()
+    if (
+      normalizedNames.has(lower)
+      || DANGEROUS_KEYS.has(lower)
+      || RESERVED_HEADERS.has(lower)
+      || !HEADER_NAME.test(name)
+      || typeof headerValue !== 'string'
+      || !headerValue
+      || LINE_BREAK.test(headerValue)
+    ) {
+      return fail()
+    }
+    normalizedNames.add(lower)
+    headers[name] = headerValue
+  }
+  return headers
+}
+
+export function decodeQuickLink(input: string): PeerInput {
+  const quickLink = input.trim()
+  if (quickLink.length > MAX_QUICK_LINK_LENGTH)
+    return fail('Jack quick link is too large')
+  if (!quickLink.startsWith(PREFIX))
+    return fail()
+
+  let payload: unknown
+  try {
+    payload = JSON.parse(decodeBase64Url(quickLink.slice(PREFIX.length)))
+  }
+  catch {
+    return fail()
+  }
+
+  if (!isRecord(payload) || payload.v !== 1 || payload.type !== 'peer')
+    return fail()
+  if (typeof payload.name !== 'string' || !payload.name.trim())
+    return fail()
+  if (typeof payload.apiKey !== 'string' || !payload.apiKey)
+    return fail()
+  if (typeof payload.url !== 'string')
+    return fail()
+
+  let url: URL
+  try {
+    url = new URL(payload.url)
+  }
+  catch {
+    return fail()
+  }
+  if ((url.protocol !== 'http:' && url.protocol !== 'https:') || url.username || url.password)
+    return fail()
+
+  const headers = parseHeaders(payload.headers)
+  return {
+    name: payload.name.trim(),
+    url: payload.url,
+    apiKey: payload.apiKey,
+    ...(Object.keys(headers).length ? { headers } : {}),
+  }
+}
diff --git a/mise.toml b/mise.toml
index c567c9c..0c28763 100644
--- a/mise.toml
+++ b/mise.toml
@@ -6,6 +6,5 @@ APP_CONFIG_PATH = "./config.jsonc"
 
 [settings]
 color_theme = "catppuccin"
-task_output = "quiet"
 
 npm.package_manager = "bun"