Create, rotate and revoke API keys
Publishers create keys under My Profile, then API Keys; networks under Workspace settings, then API Keys. Each key is shown once, when you create it. To rotate, create the new key, deploy it, check it works, then revoke the old one.
On this page
- Publishers: you’re the account’s Owner or an Admin. Keys are managed only from a signed-in dashboard: an API key can’t create, list or revoke keys.
- Networks: you’re signed in as the network’s owner; teammates can’t see or manage keys. The line above your key list, such as “Used 1 / 2 keys”, shows how many keys your account can hold. Need more? Ask us.
My Profile, then API Keys
The card lists every key on the account, with its Created, Expires and Last used dates.
Name it, then Generate Key
Type a name in Key name (optional), such as Production server, and choose Generate Key. A name tells keys apart when you rotate later.
Copy it now
Choose Copy key and store it on your server. It starts with
pk_and won’t be shown again. Your server sends it in thex-api-keyheader. New publisher keys don’t expire: they work until you revoke them.
Workspace settings, then API Keys
The list shows each key’s Prefix, Created and Expires dates.
Generate Key
Choose Generate Key, then Copy key, and store it on your server. It starts with
ak_and won’t be shown again. Your server sends it in thex-api-keyheader tohttps://.affiliateos. xyz/ network-api/ offers Note the expiry date
Network keys expire, 90 days after you generate them by default. The Expires column shows each date: rotate before it.
Generate the new key
Publishers can hold up to five keys at once, so there’s room for the new one beside the old. Networks hold one key unless we raise the limit: ask us first, and the new key goes live before the old one is removed. If you can’t wait, remove the old key, generate the new one and deploy it at once, and expect calls to fail in between.
Deploy it and make one call
Put the new key on your server and make one request with it, such as a call to the offer list, and check it answers 200.
Revoke the old key
Publishers choose Revoke on the old key’s row and confirm. Networks choose Remove. The key leaves the list and stops working.
Check it worked
A call with the old key answers 401 with
Invalid or expired API key. Publishers also see the new key’s Last used date update once your server calls with it.Hosts, headers and every key type side by side: Hosts and keys.