Use a REST API key when your server needs a custom AffiliateBase integration. Use a scoped AI connector token when connecting an MCP client on your computer, such as Claude Code, Cursor, or Codex. ChatGPT connects by signing in, with no token.
Choose the credential for your workflow
| Your goal | Start here |
|---|---|
| Read or manage program records from your own application | REST API authentication |
| Connect ChatGPT | Connect AffiliateBase to ChatGPT |
| Connect Claude Code, Cursor, Codex, or another MCP client | Use AffiliateBase MCP |
| Install browser referral tracking | Install the tracking script |
| Receive affiliate events on your server | Set up outbound webhooks |
Create a REST API key
- Go to Settings -> API Keys.
- Under Create API key, enter a Key name.
- Choose Expires after: 1 year (the default), 30 days, 90 days, or No expiry.
- Click Create key.
- Copy the secret from the Copy your API key now panel. AffiliateBase shows it only once.
Each key created here has full access to the v1 API for your account. The Active API keys table lists each key’s name, access, prefix, creator, last use, and expiry.
Revoke an API key
- Go to Settings -> API Keys.
- In the Active API keys table, open API key actions for the key.
- Click Revoke key and confirm.
Clients using a revoked key stop working immediately. The key then appears under Recently revoked.
Rate limits
The API limits how often you can call it. If you receive 429, wait for the time in the Retry-After header, then retry. See rate limits in the API reference.
Keep credentials private
Keep REST API keys on your server. Do not put them in browser scripts, public repositories, affiliate links, or screenshots. AffiliateBase shows the API secret only once, when you create the key. Store it securely.
Keys you create in Settings -> API Keys expire after 1 year by default. You can choose a shorter expiry or none when you create a key. Replace a key before the date in the Expires column; expired keys stop working.
Browser tracking uses your account ID and generated referral state. It does not require embedding a privileged REST API key in your website.
Give your developer the reference
The authentication reference covers supported headers and account scoping. The endpoint reference describes available resources, and the OpenAPI specification provides a machine-readable contract.
Start with one read request for the intended account before adding write operations. If authentication fails, check the key, account scope, and the exact error returned by the API. A 401 usually means the key is wrong, expired, or revoked. A 429 means too many requests; wait for the Retry-After seconds before retrying.