Affiliate API¶
The Affiliate API lets an external affiliate integration read its referred customers and their financial transactions. It uses a dedicated revocable JWT issued by a manager. Affiliate cabinet login sessions are not accepted by these integration endpoints.
Authorization¶
Send the token directly in the Authorization header. The API does not use the Bearer scheme.
Authorization: {JWT_TOKEN}
The token is bound to one affiliate and one brand. The server derives both values from the verified token; request parameters cannot select another affiliate or brand.
A token may contain these scopes:
| Scope | Grants access to |
|---|---|
customers:read |
GET /api/affiliate/v1/customers |
transactions:read |
GET /api/affiliate/v1/transactions |
Every request verifies the JWT signature and checks the token record, owner, brand, scope, expiration, revocation status, active affiliate status, and active affiliate access to the brand. Revocation therefore takes effect on the next request.
Issuing and revoking tokens¶
Managers control tokens through:
The complete JWT is returned only once, when it is created. Store it as a secret. Token list responses contain metadata only.
Pagination¶
Both endpoints use descending cursor pagination. Start without cursor; use next_cursor for the next request while has_more is true. Page size defaults to 100 and is limited to 1–500 records.