API Changelog

POST /v1/conversions (and the MCP create_conversion tool) answers 403 insufficient_permissions for a live key made by, or a connector approved by, a team member without the "Manage payouts" permission: a live conversion is a commission the brand will pay. Keys made by the owner are unaffected, and test keys still create test conversions.

POST /v1/campaigns answers 403 insufficient_permissions when autoApproveCommissionsAfterDays is set by a key made by, or a connector approved by, a team member without the "Manage payouts" permission: turning it on approves commissions with nobody clicking. Leave it out or send null. Separately, a commission whose sale was partly refunded without the refunded amount (GoPay, Fourthwall) is never approved automatically; it waits for you.

POST /v1/campaigns accepts autoApproveCommissionsAfterDays: 7, 14, 30, 60 or 90 approves each pending commission that many days after the sale unless it was refunded, and null (the default) leaves every approval to you. GET /v1/campaigns/:id returns the setting. Only commissions from approved affiliates are approved this way; a sale reported only by the tracking script, or a commission more than 5 times its sale, always waits for a person.

PATCH /v1/conversions/:id answers 409 commission_above_sale and changes nothing when you approve a commission more than 5 times its sale (sale amount plus tax), or any commission on a zero sale. Resend with confirmAboveSale: true once a person has checked it. The same check applies in the dashboard and to the MCP update_conversion tool.

GET /v1/stats, GET /v1/stats/overview and GET /v1/affiliates/:id now also return money per currency: byCurrency (and commissionByCurrency on each top affiliate in the overview), one entry per currency, never converted. The existing single-number fields are unchanged and still add every currency together, so read byCurrency if you sell in more than one currency. Two related fixes: GET /v1/stats and GET /v1/affiliates/:id now count live sales for a live key and test sales for a test key (they counted both), and overview top affiliates are ranked comparing currencies at the day's exchange rate.

Create an affiliate directly (no email invite, no sign-up) and attach them to a campaign, auto-approved, returning a ready-to-share trackingLink. These affiliates have no login account: they are tracking/payout records you pay directly (CSV export or your own system), with no affiliate portal or automated Stripe Connect payout. A duplicate email returns 409. GET /v1/affiliates and GET /v1/affiliates/:id now also include a trackingLink field. Requires the Ultimate or Scale plan.

New lj_pk_test_ key prefix for prototyping. Test keys tag writes with is_test=true, skip real email sends, skip webhook dispatch, and skip earnings limit checks. Dashboards filter test data by default. Live keys keep the lj_pk_ prefix (backwards compatible).

Dedicated setup guides for Claude Desktop, ChatGPT, Cursor, VS Code, Windsurf, and other MCP clients. Each includes verified config snippets, deeplink install buttons where supported, and official documentation links.

Task-oriented tutorials under /developers/guides, track a conversion, invite affiliates programmatically, sync conversions from your database, auto-approve commissions, set up webhooks, build a custom dashboard.

Outbound webhook URLs now validated via isPublicHttpsUrl(), blocks localhost, 127.0.0.0/8, RFC1918 private ranges, 169.254 metadata endpoints, 100.64 CGNAT, IPv6 loopback, and .local/.internal hostnames. Re-checked on test dispatch.

Parity with webhook handlers: hasReachedMonthlyEarningsLimit() blocks conversions past plan cap, detectSelfReferral() runs when clickId + customerEmail are supplied. Test keys bypass both.

Every write (POST/PATCH/DELETE) and every failed auth attempt is now logged with api_key_id, merchant_id, method, path, status_code, error_code, ip_address, user_agent. Successful GETs skipped. Query via Neon MCP for abuse investigation.

Lightweight key-verification endpoint. Returns merchant info, key permissions, keyType (live/test), plan, and current rate-limit status. Replaces hitting a real endpoint to check if your key works.

Fetch a single affiliate with campaign associations and aggregated earnings across your campaigns.

POST /v1/webhooks/:id/rotate generates a new signing secret. POST /v1/webhooks/:id/test sends a signed ping event and returns the HTTP status from your URL.

All list endpoints (campaigns, affiliates, conversions) accept sort=<field>:<asc|desc>. Default sort varies per endpoint.

Pro plan bumped to 60 req/min (from 10). Ultimate plan bumped to 300 req/min (from 10). The /v1/affiliates/invite endpoint has a tighter 10/min cap to protect email deliverability.

All errors now use { error: { code, message, details? } } envelope with a consistent machine-readable code. Previously some endpoints returned { error: "string" }. Old callers may need to update parsing.

Every API response now includes X-API-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, and proper CORS headers. 429 responses include Retry-After.

Public REST API with 15 endpoints covering campaigns, affiliates, conversions, stats, webhooks. Bearer token auth via lj_pk_ keys. Available on Professional (read-only) and Ultimate (read + write) plans.