Manage program settings and your API key

Everything you configured in the setup wizard stays editable after launch, and the same Settings page holds the API key that every server-side tracking call authenticates with. This guide shows where each setting lives, how to change terms safely, and how to rotate the key without breaking tracking.

What lives in Settings

Open your brand workspace and select Settings in the left menu. The page is organized as a checklist of sections:

Step 1: Edit program terms after launch

Programs evolve — rates get adjusted, branding gets refreshed, approval policies tighten or loosen. None of this requires recreating the program.

1. Select Settings in the left menu of your brand workspace.
2. Choose the section you want to change: Commission for the default rate and hold period, Approval mode to switch between manual review and auto-accept, Business Profile for the program name, website, and logo, or Branding for your marketplace page.
3. Make the change and save the section.

Step 2: Find your API key

Every server-side call to the tracking API — sales, refunds, and server-mode leads — authenticates with a Bearer token that is unique to your program. Integrations, SDKs, the CLI, and AI agents all use this same key.

1. Select Settings in the left menu.
2. Under Developer, select API Key.

The key is stored hashed and displays masked. The full value is revealed exactly once — at the moment it is generated. If you no longer have the current key stored anywhere, you can't recover it from the dashboard; regenerate it instead (Step 3).

Store the key as a server-side environment variable:

# .env — server-side only. Never ship this key to the browser.
AFFITOR_API_KEY=YOUR_PROGRAM_API_KEY

Step 3: Regenerate the key

Rotate the key if it may have leaked, if it was committed to a repository, or as routine hygiene when a team member with key access leaves.

1. In Settings → API Key, regenerate the key.
2. Copy the new key from the one-time reveal.
3. Update AFFITOR_API_KEY everywhere the old key was stored — deployment environment, secret manager, CI — and redeploy.

Verify it worked

Send a test-mode sale with the new key. It authenticates exactly like a real sale but creates no commission and no platform fee.

Request — POST /api/v1/track/sale:

curl -X POST https://api.affitor.com/api/v1/track/sale \
  -H "Authorization: Bearer YOUR_PROGRAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "additional_data": { "test_mode": true },
    "amount_cents": 9999,
    "currency": "USD",
    "sale_type": "payment"
  }'

Expected response:

{
  "success": true,
  "message": "Test sale event tracked successfully",
  "data": {
    "eventId": 789,
    "programId": 1,
    "test_mode": true
  }
}

Next steps