Authentication

Affilibee API endpoints use Bearer token authentication. Your platform should send the token in the Authorization header for every authenticated request.

Use the token generated in the Affilibee dashboard under Settings -> API Tokens. Treat that token as a server-side credential and avoid exposing it in client-side code or browser requests.

Required header

Include the token in the Authorization header using the Bearer format:

Authorization: Bearer <your_token>

The request should also be sent as JSON when calling JSON endpoints such as Create order.

How authentication fits into the flow

Authentication is the final step before the request leaves your platform. By the time the token is used, your system should already have captured the affiliate slug, stored it on the order, and determined that the order is ready to be submitted.

That is why authentication errors are usually straightforward to isolate. If a request fails before it reaches endpoint validation, first confirm that the token is present, correctly formatted, and still valid for the merchant account you are using.

Common authentication mistakes

• omitting the Bearer prefix in the Authorization header
• sending the token from frontend code instead of a trusted backend service
• using an outdated or revoked token
• debugging a token issue before confirming that the request is actually reaching the correct environment and endpoint

Where to go next

Continue with Rate limits to understand API usage restrictions, or skip to Create order for the request payload and response contract. If you are still planning the full integration, return to API integration.