Become an affiliateStart your program

Technology and tracking

API integration

Also called API, API connection, application programming interface, programmatic integration.

Short answer

An API integration is a programmatic connection in which two systems exchange data directly over HTTP rather than through a user interface. In affiliate marketing it is used to fetch reports, send conversions and update product feeds automatically.

Definition of API integration.

An API integration has three parts: an endpoint, authentication and a data format. The client calls a URL with a key or token in the header, and the server responds with structured data – almost always JSON. Unlike a manual export, the call runs on the machine's terms: every night at 04:00, every hour, or in the same second an order comes in.

Data flows in two directions. Pull is when the affiliate or the store fetches something: statistics, program lists, product feeds, payout history. Push is when the store's system sends something in – typically a completed order, registered as a conversion server-to-server. Push is the robust direction, because it does not depend on whether a script managed to run in the customer's browser.

Three things decide whether an API integration holds up in production. Authentication: the key should have the fewest possible permissions. Rate limits: how many calls are allowed per minute, and what happens when the ceiling is hit. Idempotency: the same order must be able to be sent twice without counting twice. Skip idempotency and you only find out when a network error has triggered a resend.

What an API integration is used for

For the affiliate: collecting clicks, sales and commission from several programs in a spreadsheet or dashboard, fetching product feeds for price comparison and pulling down new campaigns and rates automatically. Report endpoints are the ones called most often – an affiliate with 20 programs saves 20 logins a day.

For the store: sending conversions in server-to-server, reporting a refund back, updating a product feed daily and fetching commission owed for the bookkeeping. An e-commerce platform with a ready-made app hides the API behind an installation. It is still an API integration – just one someone else has written.

API keys and access

An API key is a password in text form. It belongs in the server's environment variables – never in frontend code, never in git and never in a chat. A key that only needs to read reports should not also be able to create conversions.

Signed webhooks are the alternative in the direction where a system sends to you. Instead of you storing a secret with the sender, the sender sends a signature you can verify. The receiver can confirm who the sender is without ever being able to act on the sender's behalf.

API integration vs. webhook

AspectAPI integrationWebhook
Who starts the callyou – you ask when you want datathe sender – it calls you when something happens
Timingon a schedule or on requestthe moment the event happens
Typical usereports, product feeds, lookupsorder completed, order refunded, subscription renewed
When the receiver is downyou try again when you are readythe sender resends – and you must be able to handle duplicates

Use an API when you need data at a time you decide, and a webhook when something has to happen in the same second as the event.

How it goes wrong

  • 01

    The key sits in the frontend

    An API key in JavaScript that runs in the browser is public. Anyone with developer tools can read it and call the API as you. Always call the API from your own server.

  • 02

    No idempotency key

    If the same order is sent twice after a timeout or a restart, it counts twice unless the receiver deduplicates. Send a stable order ID every time, and let the receiver reject the repeat.

  • 03

    429 and 503 treated as errors

    An API that responds with 429 or 503 is saying try again later – not the sale does not exist. Without backoff and a retry queue, exactly the conversions that hit an unlucky moment disappear.

At Affilyflow

API integration in practice

Affilyflow accepts conversions server-to-server, and the same order can never count twice: conversions are deduplicated on order or invoice ID per program, so a resend after a timeout does not create double commission.

A store's webhook can only credit the store's own program – if an event comes in that points elsewhere, it is rejected. For Stripe we never ask for your API key, only for a webhook signing secret, which can only be used to verify that the event came from you.

Frequently asked questions

What is the difference between an API integration and a tracking pixel?

A tracking pixel runs in the customer's browser and can be blocked by ad blockers, browser settings or an error in another script. An API integration sends the order from the store's server to the network's server and is unaffected by the browser. Many stores run both and let deduplication on order ID remove the duplicates.

Do I need to be able to code to use an API integration?

For a ready-made app or plugin, no – the installation calls the API for you. For anything else, yes: you or your developer must be able to make an HTTP call with a key, read JSON and handle errors. For a developer who knows the store's backend, it is a few hours of work.

How often can I call an affiliate API?

That is decided by the network's rate limit, which is stated in the documentation and enforced with HTTP status 429. Report data rarely changes more often than once an hour, so one call per hour per report is enough for most purposes. Conversions, on the other hand, are sent the moment the order comes in.

What do I do if the API call fails in the middle of an order?

Put the call in a queue and retry with increasing waiting time instead of failing the order. The customer's purchase must never depend on an external API responding. Always send the order ID, so a resend is recognised as a duplicate rather than as a new sale.

Read on