Partners API

Authentication

One bearer header, scoped credentials, and the endpoint access they unlock.

The Authorization header

Join your client_id and client_secret with a colon and send them as a standard bearer token on every request:

Request headerhttp

Authorization: Bearer {{client_id}}:{{client_secret}}

In practice, with credentials kept in environment variables:

Authenticated requestbash

curl "https://api.superfiliate.com/api/v1/customers?email=alice@example.com" \
  -H "Authorization: Bearer $SF_CLIENT_ID:$SF_CLIENT_SECRET"

Credential anatomy

client_id identifies your integration and starts with sfci1_. We store only a one-way digest of it, so it cannot be recovered from our side — keep your copy safe.
client_secret always starts with sfcs1_, which makes accidental leaks easy to find with code search. It also signs every webhook payload we send you — see verifying webhook signatures.

Scopes

Every credential carries a set of scopes, and every endpoint requires one. Write access implies read access for the same resource — a credential with customers.write can also call every customers.read endpoint.

Scope	Unlocks
`attribution.read`	Get attribution installation
`campaigns.read`	List campaigns
`conversions.read`	Search conversions
`customers.read`	Search customers and customer insights
`customers.write`	Create, enroll, add balance, and redact customers
`discounts.read`	List and get discount codes
`gifting_rewards.read`	List gifting rewards
`gifting_rewards.write`	Fulfill gifting rewards
`orders.write`	Create or update orders
`products.read`	List products
`products.write`	Create products
`reports.write`	Create custom reports
`reports.read`	List reports and fetch report data
`webhooks.read`	List webhooks
`webhooks.write`	Create and remove webhooks

Each endpoint's page in the API reference shows the scope it requires, right under the title.

401 vs 403

Two different problems, two different status codes:

401 Unauthorized — the credentials are missing or wrong. Check the header format and that the pair is active.
403 Forbidden — the credentials are valid, but they lack the scope this endpoint requires. Generate a new key with the missing scope — existing keys cannot be edited.

401 · wrong or missing credentialsjson

{ "errors": ["Unauthorized"] }

403 · missing scopejson

{ "errors": ["Forbidden"] }