Manage program settings and your API key

Everything you configured in the setup wizard stays editable after launch, and Settings also hold the API key that every server-side tracking call authenticates with. This guide shows where each setting lives, how to change terms safely, and how to rotate the key with the shortest possible gap in tracking.

What lives in SettingsCopy Anchor Link

Settings belong to the program selected in the program menu. Open the program menu (your program's name at the top of the left menu, or in the top bar on smaller screens) and choose All settings. Everything on the Settings pages applies to that program.

Program settings are the same five steps as setup, one page each:

The rest of the Settings menu:

Step 1: Edit program terms after launchCopy Anchor Link

Programs evolve — rates get adjusted, branding gets refreshed, approval policies tighten or loosen. None of this requires recreating the program.

1. In the program menu, choose All settings.
2. Open the page you want to change: Commission for the rate, hold period and how new partners join, or Business for the business name, website, logo and branding.
3. Make the change and save. On Commission, once terms are saved, select Set new terms before you change them.

Step 2: Find your API keyCopy Anchor Link

Every server-side call to the tracking API — sales, refunds, and server-mode leads — authenticates with a Bearer token that is unique to your program. Integrations, SDKs, the CLI's tracking setup, and AI agents all use this same key. CLI commands that create or list programs act as your account instead, and authenticate with your CLI login.

1. In the program menu, choose All settings.
2. Under Developers, select API keys.

The dashboard displays the key masked, and no read returns the full value. It is revealed exactly once — in the response to an owner's Generate or Regenerate action on the API keys page. If you no longer have the current key stored anywhere, you can't recover it from the dashboard; regenerate it instead (Step 3).

Store the key as a server-side environment variable:

# .env — server-side only. Never ship this key to the browser.
AFFITOR_API_KEY=YOUR_PROGRAM_API_KEY

Step 3: Regenerate the keyCopy Anchor Link

Rotate the key if it may have leaked, if it was committed to a repository, or as routine hygiene when a team member with key access leaves.

Only a workspace owner can regenerate a program key. A member who tries is refused, so ask an owner to run it and to hand you the new value through your secret manager.

1. Line up every place AFFITOR_API_KEY is stored — deployment environment, secret manager, CI — so you can update them straight away.
2. In Settings → API keys, regenerate the key. The old key stops working at that moment.
3. Copy the new key from the one-time reveal, update those places, and redeploy.

Verify it workedCopy Anchor Link

Send a test-mode sale with the new key. It authenticates exactly like a real sale but creates no commission and no platform fee.

Request — POST /api/v1/track/sale:

curl -X POST https://api.affitor.com/api/v1/track/sale \
  -H "Authorization: Bearer YOUR_PROGRAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "additional_data": { "test_mode": true },
    "amount_cents": 9999,
    "currency": "USD",
    "sale_type": "payment"
  }'

Expected response:

{
  "success": true,
  "message": "Test sale event tracked successfully",
  "data": {
    "eventId": 789,
    "programId": 1,
    "test_mode": true
  }
}

Next stepsCopy Anchor Link