Authentication

All requests are authorized with a bearer token:

Authorization: Bearer <token>

Tokens are stored as SHA-256 hashes and compared in constant time.

Workspace keys (`sa_live_…`)

Grant access across the whole workspace. Authorization is governed by scopes on the key:

Scope	Grants
(empty)	Read access
`read`	List and fetch affiliates, commissions, conversions, payouts, reports
`write`	Create/update affiliates, links, commissions, webhooks, and conversions
`track`	`POST /v1/track/*` server-to-server tracking (`write` also grants this)
`*`	Everything

A key with no scopes can still read. Writes require write (or *); tracking requires track (or *).

Status	Body	Meaning
401	`{ "error": "unauthorized" }`	Missing / invalid token
403	`{ "error": "insufficient_scope", "need": "…" }`	Token lacks the needed scope
400	`{ "error": "…_required" }`	Missing required field
404	`{ "error": "unknown_resource" }`	Unknown path / not in workspace