Affitor Com Authentication

generated: '2026-10-31'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://affitor.com/docs/brand/settings
sources:
- https://affitor.com/docs/brand/settings
- https://affitor.com/docs/brand/api-keys
- https://affitor.com/auth.md
- https://affitor.com/docs/api-reference/integrations/nextjs-supabase
description: Authentication methods for Affitor
schemes:
- type: http-bearer
  name: Program API key
  evidence: Every server-side call to the tracking API — sales, refunds, and server-mode leads — authenticates with a Bearer token that is unique
    to your program.
  location: header
  header: Authorization
  how_to_obtain: A workspace owner opens Program settings → API keys in the Affitor dashboard and selects Generate (or Regenerate); the full key
    is shown once in that response.
- type: http-bearer
  name: Agent API key
  evidence: Separately from program keys, Affitor issues agent API keys (prefix agt_ ) to approved tools that read and update programs on a brand's
    behalf through the /api/agent/v1/... endpoints.
  location: header
  header: Authorization
  how_to_obtain: Issued by Affitor to approved tools; contact support to obtain.
- type: oauth2
  name: MCP server OAuth
  evidence: Read a brand's program or a partner's data from an AI app – The MCP server, signed in with OAuth as an Affitor user, scope `read`.
  location: header
  header: Authorization
  flows:
  - authorization_code
  authorize_url: https://mcp.affitor.com/oauth/authorize
  scopes:
  - read
  how_to_obtain: Clients register via dynamic client registration at https://mcp.affitor.com/oauth/reg and then perform the authorization code
    flow with PKCE.
docs: https://affitor.com/docs/brand/settings