Get a Dynamic URL

Gives a template one permanent, embeddable address. The data travels in the URL, signed, and the document is rendered the first time someone asks for it — no API call per document. **One Dynamic URL serves every recipient.** The same address renders a certificate for each student or an invoice for each customer; only the payload differs. Create a second one when you want separate controls — its own expiry, or a signing secret revocable without touching the first — never one per recipient. The response includes the signing secret and a `sample_url` that renders as-is. The secret is derived rather than stored, so it can be read again later with `include_secret=true` — losing it does not force a rotation. **Signing your own:** HMAC-SHA256 over `{token}/{extension}?{query}`, with the query sorted and `s` left out. No hostname and no path, so a signature survives the URL moving.