Skip to content

Authentication#

The Partner API supports three authentication modes depending on the endpoint.

JWT Bearer token#

Used by logged-in partners (for example, from the partner dashboard or a personal script). Obtain a token by logging in, then send it on every request:

Authorization: Bearer <jwt_token>

The authenticated user must have the partner or admin privilege. Requests from accounts without these privileges are rejected.

All referral-link and API-key management endpoints use this mode — see Referral Links & API Keys.

API key (X-API-Key)#

Used for server-to-server automation, where logging in interactively isn't practical. Generate a key with POST /partner/api-keys (which requires a JWT, see above), then send it on requests:

X-API-Key: <token>

The raw key is shown only once

The plaintext token is returned only in the response to POST /partner/api-keys. It is stored hashed (bcrypt) and can never be retrieved again. If you lose it, revoke the key and create a new one. Listing keys (GET /partner/api-keys) returns token: null.

Each successful API-key request updates the key's last_used timestamp.

Currently the only API-key endpoint is POST /partner/api/referral-links.

Public (no authentication)#

The end-user trial endpoints require no authentication, since the user does not yet have an account:

  • GET /partner/referral/{code}/validate
  • POST /partner/trial/claim

The claim endpoint is rate-limited to 5 requests per hour per IP address. See Trial Claim.