Authentication

Create the key while signed in. Call the API with the key and a signature. The secret is shown once.

Create a key

Brands: company dashboard, Credentials, Direct API. Up to five active keys.
Influencers and creators: the key icon next to the wallet, on /u/home/credentials. The list follows the role you have selected.

Store the secret next to the key. Revoke a key when that workflow should stop. A revoked key cannot be used again.

Headers

X-Api-Key — the key, starting with ak_
X-Timestamp — Unix seconds, within five minutes of the server
X-Signature — lowercase hex HMAC-SHA256 of the payload

The payload is four lines joined by a newline: the uppercase method, the request URI (path and raw query), the timestamp, and the raw body. A GET, and a POST with no body, sign an empty body.

METHOD
/api/v1/affilink/me
1710000000

Errors

Failures are JSON: { "error": { "code", "message" } }. Codes include unauthorized, invalid_signature, timestamp_expired, permission_denied, not_found, validation_error, and internal_error. Do not retry a 4xx until you change the request. Retry a 5xx with backoff.

Lists

limit defaults to 25 and stops at 100. Responses include data and, when another page exists, next_cursor. Send that value back as cursor.