Authentication

Affilibee API endpoints use Bearer token authentication. Your platform should send the token in the Authorization header for every authenticated request.

Use the token generated in the Affilibee dashboard under Settings -> API Tokens. Treat that token as a server-side credential and avoid exposing it in client-side code or browser requests.

Required header

Include the token in the Authorization header using the Bearer format:

Authorization: Bearer <your_token>

The request should also be sent as JSON when calling JSON endpoints such as Create order.

Live and testing tokens

When you create a token you choose its environment, and it only works against that environment:

• Live tokens work on the live API (/api/v2/...) and read and write your real data.
• Testing tokens work on the sandbox API (/api/v2/sandbox/...) and only ever touch sandbox data.

Using a token against the other environment returns 403 Forbidden before anything is read or changed, so an integration under test can never affect live orders, affiliates or commissions.

How authentication fits into the flow

Authentication is the final step before the request leaves your platform. By the time the token is used, your system should already have captured the affiliate slug, stored it on the order, and determined that the order is ready to be submitted.

That is why authentication errors are usually straightforward to isolate. If a request fails before it reaches endpoint validation, first confirm that the token is present, correctly formatted, and still valid for the merchant account you are using.

Common authentication mistakes

• omitting the Bearer prefix in the Authorization header
• sending the token from frontend code instead of a trusted backend service
• using an outdated or revoked token
• using a testing token on the live API, or a live token on the sandbox API
• debugging a token issue before confirming that the request is actually reaching the correct environment and endpoint

Where to go next

Continue with Rate limits to understand API usage restrictions, or skip to Create order for the request payload and response contract. If you are still planning the full integration, return to API integration.