diff --git a/skills/mpm-url-shortener/plugin/mpm-api-extras.php b/skills/mpm-url-shortener/plugin/mpm-api-extras.php
new file mode 100644
index 0000000..b519fa8
--- /dev/null
+++ b/skills/mpm-url-shortener/plugin/mpm-api-extras.php
@@ -0,0 +1,135 @@
+<?php
+/*
+Plugin Name:  MPM API Extras
+Plugin URI:   https://mpm.to
+Description:  Adds 'delete' and 'update' actions to the YOURLS API so all CRUD
+              operations can be performed using the signature token alone — no
+              admin username/password required.
+Version:      1.0
+Author:       Message Point Media
+*/
+
+// ── Register the new action names ────────────────────────────────────────────
+
+yourls_add_filter( 'api_list_actions', 'mpm_api_register_actions' );
+
+function mpm_api_register_actions( $actions ) {
+    $actions[] = 'delete';
+    $actions[] = 'update';
+    return $actions;
+}
+
+
+// ── DELETE ────────────────────────────────────────────────────────────────────
+// Usage:  POST /yourls-api.php
+//   signature=<token>&format=json&action=delete&keyword=<code>
+
+function yourls_api_action_delete() {
+    $keyword = isset( $_REQUEST['keyword'] )
+        ? yourls_sanitize_keyword( $_REQUEST['keyword'] )
+        : '';
+
+    if ( ! $keyword ) {
+        return array(
+            'status'    => 'fail',
+            'message'   => 'Missing required parameter: keyword',
+            'errorCode' => '400',
+            'simple'    => 'Missing keyword',
+        );
+    }
+
+    if ( ! yourls_keyword_exists( $keyword ) ) {
+        return array(
+            'status'    => 'fail',
+            'message'   => "Short URL not found: {$keyword}",
+            'errorCode' => '404',
+            'simple'    => 'Not found',
+        );
+    }
+
+    $deleted = yourls_delete_link_by_keyword( $keyword );
+
+    if ( $deleted ) {
+        return yourls_apply_filter( 'api_result_delete', array(
+            'status'     => 'success',
+            'message'    => "Short URL deleted: {$keyword}",
+            'statusCode' => '200',
+            'simple'     => 'deleted',
+        ) );
+    }
+
+    return array(
+        'status'    => 'fail',
+        'message'   => "Could not delete: {$keyword}",
+        'errorCode' => '500',
+        'simple'    => 'delete failed',
+    );
+}
+
+
+// ── UPDATE ────────────────────────────────────────────────────────────────────
+// Usage:  POST /yourls-api.php
+//   signature=<token>&format=json&action=update&keyword=<code>
+//   [&url=<new-long-url>] [&newkeyword=<new-code>] [&title=<new-title>]
+//
+// Any combination of url / newkeyword / title may be supplied; omitted fields
+// keep their current values.
+
+function yourls_api_action_update() {
+    $keyword = isset( $_REQUEST['keyword'] )
+        ? yourls_sanitize_keyword( $_REQUEST['keyword'] )
+        : '';
+
+    if ( ! $keyword ) {
+        return array(
+            'status'    => 'fail',
+            'message'   => 'Missing required parameter: keyword',
+            'errorCode' => '400',
+            'simple'    => 'Missing keyword',
+        );
+    }
+
+    // Resolve current values for any fields not supplied
+    $current_url   = yourls_get_keyword_longurl( $keyword );
+    $current_title = yourls_get_keyword_title( $keyword );
+
+    if ( ! $current_url ) {
+        return array(
+            'status'    => 'fail',
+            'message'   => "Short URL not found: {$keyword}",
+            'errorCode' => '404',
+            'simple'    => 'Not found',
+        );
+    }
+
+    $new_url     = isset( $_REQUEST['url'] )
+        ? yourls_sanitize_url( $_REQUEST['url'] )
+        : $current_url;
+
+    $new_keyword = isset( $_REQUEST['newkeyword'] )
+        ? yourls_sanitize_keyword( $_REQUEST['newkeyword'] )
+        : $keyword;
+
+    $new_title   = isset( $_REQUEST['title'] )
+        ? yourls_sanitize_title( $_REQUEST['title'] )
+        : $current_title;
+
+    $result = yourls_edit_link( $new_url, $keyword, $new_keyword, $new_title );
+
+    if ( isset( $result['status'] ) && $result['status'] === 'success' ) {
+        return yourls_apply_filter( 'api_result_update', array(
+            'status'     => 'success',
+            'message'    => 'Short URL updated',
+            'statusCode' => '200',
+            'shorturl'   => yourls_link( $new_keyword ),
+            'simple'     => yourls_link( $new_keyword ),
+        ) );
+    }
+
+    return array(
+        'status'    => 'fail',
+        'message'   => isset( $result['message'] ) ? $result['message'] : 'Update failed',
+        'errorCode' => '400',
+        'simple'    => 'update failed',
+    );
+}