Authentication

All API requests require a Bearer token in the Authorization header. Keys are scoped to your merchant account, so you can only access your own data.

Authorization: Bearer lj_pk_your_api_key_here

Plan Access

Scale keys are read and write, the same as Ultimate. The Affiliate Teams endpoints (teams, goals, and bonus awards) require a Scale-priced account; on other plans they return 403 plan_insufficient.

Rate Limits

API requests are rate-limited per key. Every response includes these headers:

X-RateLimit-Limit: 60        # Requests allowed per minute
X-RateLimit-Remaining: 47    # Remaining in current window
X-RateLimit-Reset: 1713100860 # Unix timestamp when limit resets

Limits: 60 req/min on Professional, 300 req/min on Ultimate. The /v1/affiliates/invite endpoint has a tighter 10/min cap to protect email deliverability. When exceeded, you get 429 with a Retry-After header; honor it.

Pagination

All list endpoints use page-based pagination with these query parameters:

GET /api/v1/conversions?page=1&limit=25&sort=createdAt:desc

page starts at 1. limit defaults to 25, max 100. sort uses field:direction (e.g. amount:desc).

Response envelope

{
  "data": [ /* array of items */ ],
  "pagination": {
    "page": 1,
    "limit": 25,
    "total": 412,
    "totalPages": 17
  }
}

Idempotency

Writes that could create duplicates (conversions, invitations) accept a natural unique key you supply. Re-submitting the same key returns 409 duplicate instead of creating a second record, safe to retry on network failures.

Best practice: wrap write calls in a retry loop that treats 409 as success. Use exponential backoff for network errors and 5xx.

Errors

Errors use a consistent envelope with a machine-readable code, human-readable message, and optional details array for validation errors:

{
  "error": {
    "code": "validation_error",
    "message": "Validation failed",
    "details": [
      { "path": ["amount"], "message": "amount must be positive" }
    ]
  }
}

Status codes