What the Affiliate API Does
| Endpoint | Purpose |
|---|---|
GET /af/campaigns | Campaigns the affiliate is approved for, with tracking URL, payout, targeting, caps, payout rules and creatives — paginated and cached for 60 seconds. |
POST /af/campaign-request | Apply to run a campaign that needs approval. The request lands in your normal approval queue. |
GET /af/reports | The affiliate's own clicks, conversions and payout for a date range. |
An affiliate only ever sees their own data. The full request and response reference is on the API documentation site under Affiliate Campaign API.
Requirements
An affiliate can authenticate only when all four are true. The API Access tab on the affiliate's profile shows each one as a green tick or a red cross, so you can see at a glance why a partner's calls fail.
- Plan includes API access — your subscription or an add-on includes the Affiliate API.
- API access turned on for this affiliate.
- Affiliate account is active — pending, rejected or blocked accounts are refused.
- An API key has been generated.
Turning On API Access
-
Open the affiliate
Affiliates → All Affiliates, then open the row's action menu and choose API Access (the badge shows On or Off). It opens the profile on the API Access tab.
-
Switch on Allow API access for this affiliate
Switching it off takes effect on the very next request — the affiliate's key is rejected straight away, not after a cache delay.
-
Share the connection details
The Connection details panel lists the Base URL, your Domain ID and the Affiliate ID, each with a copy button, plus a ready-to-run example request.
Changing API access needs the Edit Affiliates permission.
Generating & Revoking Keys
- Affiliate generates it — the usual route. In their portal under Account → API Access the affiliate creates their own key, so you never handle the secret.
- You generate it — for partners who want you to set them up. The new key is shown once with Copy this API key now; after that only its last four characters are displayed. Generating a new key replaces the old one, which stops working immediately.
- Revoke — use it when a key may have leaked. The key is deleted but API access stays on, so the affiliate can generate a fresh key themselves.
Send keys through a password manager or a secure channel, never in a ticket or chat thread. Every key generated by your team is recorded with who generated it.
Making a Request
Every call sends three headers. There is no OAuth flow or token exchange.
curl -X GET "https://api.affclix.com/v1/af/campaigns?page=1&limit=50" \
-H "X-Domain-Id: 10001" \
-H "X-Affiliate-Id: 2045" \
-H "X-Api-Key: <affiliate-api-key>" \
-H "Accept: application/json"| Header | Value |
|---|---|
X-Domain-Id | Your network's Domain ID — the same for all your affiliates. |
X-Affiliate-Id | The affiliate's ID. |
X-Api-Key | The affiliate's secret key. |
IP Allowlist & Rate Limits
IP allowlist. Turn on Restrict API by IP whitelist under Settings → Platform Settings → Security. From then on, an affiliate who has listed IPs or IPv4 CIDR ranges in their portal (Account → API Access → API IP Allowlist) can only call the API from those addresses. An affiliate with an empty list is not locked out, so switching the policy on never breaks existing integrations. The affiliate's list is shown read-only on their API Access tab.
Rate limits. Each affiliate can make 30 requests per minute and 500 per day. Over the limit the API answers HTTP 429 with a Retry-After header; partners should cache campaign lists and pull reports on a schedule rather than per page view.
Troubleshooting
| Response | Likely cause |
|---|---|
403 Invalid affiliate credentials | Wrong Domain ID, Affiliate ID or key; the key was revoked or replaced; API access is off; or the account is not active. Check the requirements on the API Access tab. |
403 IP address is not authorised | IP restriction is on and the request came from an address outside the affiliate's allowlist. |
429 | Rate limit reached. Retry after the minute or the day resets. |