Manage program settings and your API key

Everything you configured in the setup wizard stays editable after launch, and the same Settings page holds the API key that every server-side tracking call authenticates with. This guide shows where each setting lives, how to change terms safely, and how to rotate the key with the shortest possible gap in tracking.

What lives in SettingsCopy Anchor Link

Open your brand workspace and select Settings in the left menu. The page is organized as a checklist of sections:

Step 1: Edit program terms after launchCopy Anchor Link

Programs evolve — rates get adjusted, branding gets refreshed, approval policies tighten or loosen. None of this requires recreating the program.

1. Select Settings in the left menu of your brand workspace.
2. Choose the section you want to change: Commission for the default rate and hold period, Approval mode to switch between manual review and auto-accept, Business Profile for the program name, website, and logo, or Branding for your marketplace page.
3. Make the change and save the section.

Step 2: Find your API keyCopy Anchor Link

Every server-side call to the tracking API — sales, refunds, and server-mode leads — authenticates with a Bearer token that is unique to your program. Integrations, SDKs, the CLI's tracking setup, and AI agents all use this same key. CLI commands that create or list programs act as your account instead, and authenticate with your CLI login.

1. Select Settings in the left menu.
2. Under Developer, select API Key.

The dashboard displays the key masked, and no read returns the full value. It is revealed exactly once — in the response to an owner's Generate or Regenerate action on the API Key tab. If you no longer have the current key stored anywhere, you can't recover it from the dashboard; regenerate it instead (Step 3).

Store the key as a server-side environment variable:

# .env — server-side only. Never ship this key to the browser.
AFFITOR_API_KEY=YOUR_PROGRAM_API_KEY

Step 3: Regenerate the keyCopy Anchor Link

Rotate the key if it may have leaked, if it was committed to a repository, or as routine hygiene when a team member with key access leaves.

Only a workspace owner can regenerate a program key. A member who tries is refused, so ask an owner to run it and to hand you the new value through your secret manager.

1. Line up every place AFFITOR_API_KEY is stored — deployment environment, secret manager, CI — so you can update them straight away.
2. In Settings → API Key, regenerate the key. The old key stops working at that moment.
3. Copy the new key from the one-time reveal, update those places, and redeploy.

Verify it workedCopy Anchor Link

Send a test-mode sale with the new key. It authenticates exactly like a real sale but creates no commission and no platform fee.

Request — POST /api/v1/track/sale:

curl -X POST https://api.affitor.com/api/v1/track/sale \
  -H "Authorization: Bearer YOUR_PROGRAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "additional_data": { "test_mode": true },
    "amount_cents": 9999,
    "currency": "USD",
    "sale_type": "payment"
  }'

Expected response:

{
  "success": true,
  "message": "Test sale event tracked successfully",
  "data": {
    "eventId": 789,
    "programId": 1,
    "test_mode": true
  }
}

Next stepsCopy Anchor Link