Cj Affiliate Authentication

generated: '2026-08-13'
method: searched
source: >-
  https://production-docs-assets.p.cjpowered.com/REST%20APIs/Overview.md and the
  per-API pages it indexes, plus live 401 probes of every CJ API host and the
  developer-portal bundle at https://developers.cj.com/static/js/main.*.chunk.js
docs:
- https://developers.cj.com/authentication/overview
- https://developers.cj.com/account/personal-access-tokens
provider: CJ Affiliate
providerId: cj-affiliate
summary:
  types:
  - http
  oauth2: false
  oidc: false
  mtls: false
  scopes: false
description: >-
  One credential covers CJ's entire platform: a long-lived Personal Access Token
  sent as an HTTP Bearer credential. The same token authenticates all three
  GraphQL endpoints, all the classic REST APIs and both click-tracking APIs.
  There is no OAuth 2.0, no OpenID Connect, no scopes, no refresh and no token
  endpoint a client may call — /.well-known/openid-configuration and
  /.well-known/oauth-authorization-server return 404 on every CJ host including
  iam.cj.com, the internal PAT service the developer portal itself calls.
schemes:
- name: personalAccessToken
  type: http
  scheme: bearer
  header: Authorization
  format: 'Bearer <personal-access-token>'
  issuance: manual
  issuance_url: https://developers.cj.com/account/personal-access-tokens
  expiry: not published
  refresh: false
  scopes: []
  description: >-
    A Personal Access Token created by a signed-in user in the CJ developer
    portal. CJ's REST APIs also still accept the older Developer Key in the same
    Authorization header, and the documented 401 messages reference it by name
    ("You must specify a developer key.", "Not Authenticated: <key>").
  sources:
  - https://production-docs-assets.p.cjpowered.com/REST%20APIs/Overview.md
  - openapi/_original/cj-affiliate-openapi.yml
  - graphql/cj-affiliate-graphql.md
authorization_model:
  mechanism: account membership + explicit account parameter
  description: >-
    Authentication and authorization are separated. The token establishes WHO
    the caller is; a company identifier on every request establishes WHICH
    account the call is against, and CJ authorizes it only if the token's user is
    a member of that company.
  parameters:
  - name: requestor-cid
    surface: classic REST (Advertiser Lookup, Publisher Lookup, Commission Detail Legacy)
    required: true
  - name: companyId
    surface: GraphQL ads API
    required: true
  - name: publisherCompanyId
    surface: Publisher Tracking API
    required: true
  - name: enterpriseId
    surface: GraphQL Tracking API mutations
    required: true
    note: 'Returns "Unauthorized" when the enterprise id is not associated with the token.'
  - name: forPublishers / forAdvertisers
    surface: GraphQL Commission Detail
  side_restrictions: >-
    CJ additionally gates APIs by which side of the network you are on. Link
    Search, Advertiser Lookup and the Automated Offer Feed are publishers-only;
    Publisher Lookup and the Tracking API are advertisers-only. Using a
    publisher key against Publisher Lookup returns HTTP 400 "Not Authorized" —
    not 401 and not 403.
  actor_requirements: >-
    The Click Events API requires a token generated by a user registered to the
    PARTNER's CJ account; the Publisher Tracking API requires one from a user
    registered to the PUBLISHER account. A token from the wrong account fails
    even when it is valid.
observed_challenges:
- host: link-search.api.cj.com
  probe: 'GET /v2/link-search with no Authorization header'
  status: 401
  body: '<cj-api><error-message>You must provide an Authorization header.</error-message></cj-api>'
  www_authenticate: absent
- host: commission-detail.api.cj.com
  probe: 'GET /v3/commissions with no Authorization header'
  status: 401
  body: '<cj-api><error-message>You must provide an Authorization header.</error-message></cj-api>'
  www_authenticate: absent
- host: clicks.api.cj.com
  probe: 'POST /partner/event with an empty JSON body and no Authorization header'
  status: 401
  body: '{"destinationUrl":"","errorMessages":["Authentication failed"]}'
- host: publishertracking.api.cj.com
  probe: 'POST /clickdestination with an empty JSON body and no Authorization header'
  status: 401
  body: '{"destinationUrl":"","errorMessages":["Authentication failed"]}'
- host: commissions.api.cj.com
  probe: 'POST /query with an introspection query and no Authorization header'
  status: 200
  note: >-
    GraphQL INTROSPECTION is open without credentials on all three GraphQL
    endpoints. Only the data is gated.
gaps:
- No WWW-Authenticate challenge header on any 401, so a client cannot discover the scheme from a response.
- No published token lifetime, rotation guidance or revocation API.
- No programmatic issuance. Every credential requires a human in the CJ portal, which is the practical blocker on unattended agent onboarding.
- No scopes, so a token cannot be least-privileged. One token that can read commissions can also write orders if the account is entitled to.