Authentication

Every Affiliate API request is authenticated with a program-scoped API key. The key identifies your affiliate program — no program ID is passed in any URL — and it acts as you, the program owner: affiliate-scoped routes are performed by you on the affiliate's behalf.

Getting a key

Create a key in your dashboard under Settings → API Keys (or on page 4 of the creation wizard while your program is still being set up).

• API keys are available on the Scale plan. Creating one without it fails with API keys are available on the Scale plan.
• A program can hold up to 2 active keys: Your program can have up to 2 API keys. Revoke one before creating another.
• Keys are shown once at creation — store them safely. Revoke and rotate from the same page; a revoked key stops working immediately.

Using the key

Send the key with every request using either header:

X-API-Key: rzf_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Authorization: Bearer rzf_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

A valid key is rzf_live_ followed by 64 hex characters. Keys are stored server-side as a SHA-256 hash — the plaintext is never recoverable, which is why the full value is shown only once.

Rate limits

Limits are per key owner and per minute, by request type:

Exceeding a limit answers 429 with { "error": "Too many requests. Please try again later." } and rate-limit headers.

Errors

Every error response is a JSON object with a single error field:

{ "error": "The exact human-readable message" }

The messages in the endpoint pages are the exact strings the API returns — you can match on them, but prefer matching on the HTTP status.

Any unexpected server failure answers 500 with An unknown error has occured. Please try again. (route-specific handlers may return their own 500 message, e.g. Internal Server Error on the visit beacon). Each endpoint's page lists the status-specific messages it can return.