Authentication

The header

The scheme is Bearer. A missing, malformed, unknown or revoked key always returns 401 — the four cases are told apart by the code field, never by the HTTP status.

Authorization: Bearer gaff_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

const res = await fetch('https://getaff.org/api/v1/me', {
  headers: { Authorization: `Bearer ${process.env.GETAFF_API_KEY}` },
});

if (res.status === 401) {
  // Read the code, not the message: it is the stable part of the contract.
  const { error } = await res.json();
  throw new Error(`GetAff rejected the key: ${error.code}`);
}

Shown exactly once

We only store a digest of your key, never its value. Nobody — including us — can show it to you again after creation. If you lose it, revoke it and create another: that is a routine operation.

Where to keep it

An API key grants access to your earnings. Treat it like a production password.

• In a secret manager, or failing that an environment variable.
• Never in a code repository, even a private one: private repositories get cloned.
• Never in a ticket, a chat message or a screenshot.
• One key per integration, so that revoking one does not stop the others.

If a key leaks

Revoke it immediately from the “API keys” page. Revocation takes effect on the next call. The row is kept, marked revoked, with its last-used date: that is how you find out whether the key was used after it leaked.

Scopes

Every key currently carries the read scope, the only one that exists. The field is already present in the /v1/me response so that a client written today keeps working when other scopes appear.