Authentication - Tapfiliate Developers

Every request to the REST API carries your API key in the X-Api-Key header:

curl https://api.tapfiliate.com/1.6/conversions/ \
  -H "X-Api-Key: YOUR_API_KEY"

Send the key exactly as it is shown in your account, without quotes or extra spaces. All requests must use HTTPS.

Where to find your key

Your API key is in your profile settings in the Tapfiliate dashboard. The help center shows the exact place. The key belongs to your user in one advertiser account and acts with your permissions there. It is not scoped to a single program or to read-only access.

Keep it secret

Your API key can approve commissions and change affiliate data. Use it only from your server.

Do not put it in browser code. For tracking from the browser use tapfiliate.js, which needs only your public account ID.
Do not commit it to a repository or paste it into tickets and chats.
If the key has leaked, regenerate it in your profile settings. The old key stops working immediately, including in webhooks and integrations that use it.

Errors

Status	Meaning
`401`	The key is missing or wrong. A wrong key returns `{"message": "Authentication Failed.", "code": 401}`.
`403`	The key is valid, but your user has no API access. Ask the account owner to grant the API access permission, or contact support.

Connecting AI assistants

The MCP server does not use your API key. It signs you in with OAuth, so you never paste the key into an AI tool.