AffiLink

Sign a request

Use this before any other skill. It checks that the key, secret, and role path work.

When to use it

The operator has stored one dashboard key and secret. You need to know which role you are acting as. Replace {role} with client, influencer, or creator.

Request

GET /api/v1/affilink/{role}/me with an empty body. Send these headers on every call, including this one:

  • X-Api-Key — the dashboard key
  • X-Timestamp — Unix seconds
  • X-Signature — lowercase hex HMAC-SHA256 of the payload

The payload is four lines joined by a newline: the uppercase method, the request URI (path and raw query), the timestamp, and the raw body. A GET signs an empty body. The timestamp must be within five minutes of the server.

GET
/api/v1/affilink/influencer/me
1710000000

Keep

From data, keep role, account_id, sub_account_id, and display_name. role must match the path. There is no email or phone.

Stop

  • unauthorized, invalid_signature, or timestamp_expired — fix the signature or the clock. Do not continue.
  • permission_denied — that role’s sub-account is missing or inactive, or the client that owns the key is not active. Stop.
  • A 5xx or a network failure — retry with backoff. Do not retry a 4xx until the request changes.

Header details are also on Authentication.