Affiliate software with an API: eleven references side by side, on sign-in, limits, writes and retries

By Jimi Barkway · Published 6 September 2026 · Part of the comparison pages

Which affiliate software has an API?

In shortAll eleven tools I checked publish one. The differences are elsewhere. How you sign in. How many requests you may make. What you are allowed to write, not only read. And whether the tool publishes a contract a machine can read. That is what lets a typed client or an AI assistant use it without guessing.

The research method was simple. I read the API reference of eleven affiliate tools on 6 September 2026, starting with the authentication and rate-limit pages. I found eleven APIs and nine published rate limits. Three publish OpenAPI. Eight carry an llms.txt index. Four name an MCP server. Two promise a safe retry. The links are in the sources.

Five words first. An API is a way for your own code to read and change your affiliate program without opening the dashboard. An API key is the secret string that proves the request is yours. A rate limit is how many requests the tool will answer in a given time before it refuses. A webhook is the reverse: the tool calls your server when something happens. And OpenAPI is a standard file that describes every endpoint, so tools can generate a client from it.

How do you sign in?

In shortMost with a Bearer key in the Authorization header. Two with HTTP Basic, where the key goes in the username field. One with a custom header. The shape matters less than what the key can do. Two references on the table say their keys carry scopes.

The Bearer group is AffiliateRail, Tolt, Dub, FirstPromoter's v2, Refgrow, Endorsely and PartnerStack's Partner API. AffiliateRail's keys are minted under Settings, API keys, "and carry scopes". A test key, rail_test_, works against the same organisation. It stamps a livemode header of false. Dub's keys start dub_. Refgrow's start rgk_. Tolt's come from Settings, Integrations.

The Basic group is Rewardful and impact.com. Rewardful's page says to "provide your API Secret as the basic auth username value". There is no password. It is "similar to how Stripe authenticates". impact.com's token has two parts: an Account SID as the username and an Auth Token as the password. Its page says to "use scoped tokens instead of full-access tokens", and that tokens made before April 2025 offer only read-only or read-write. Tapfiliate is the custom-header case, with X-Api-Key on every request. FirstPromoter's older v1 used X-API-KEY the same way.

For example, imagine you want a dashboard that reads commissions and nothing else. On a keyed API with scopes, you mint a read-only key and the dashboard cannot write. AffiliateRail and impact.com both say so. Two say the opposite in plain words. Tolt: "Each API key has full access to all API endpoints." Rewardful: "Your API Secret grants full access to your Rewardful account." On the rest, the pages fetched do not say. So the safety is in your own code until you check. That is the difference scopes make.

How many requests can you make?

In shortNine of the eleven publish a number. Converted to a minute, they run from about 17 on impact.com's default to 4,000 on PartnerStack. AffiliateRail and Tolt both allow 25 a second, which is 1,500 a minute. Refgrow and Endorsely each allow 100 a minute. Every tool that publishes a limit returns a 429 status when you cross it.

AffiliateRail's limit is "enforced as a token bucket that refills continuously, so short bursts above the rate are fine as long as the average holds". Every response carries X-RateLimit headers with the bucket size and what is left. Tolt's limit is the same 25 a second, per key, with a 429 and a JSON error body above it.

Rewardful's is, "in most cases", "45 requests per 30 second window", which is 90 a minute. Its page asks you to treat that as an absolute maximum. Dub's is "capped at 60 requests per minute per key on the Free plan", then 600 on Pro, 1,200 on Business and 3,000 on Advanced. FirstPromoter's is "400 requests per minute per account". PartnerStack's is "4000 requests per minute per IP address". impact.com's is "1,000 requests per hour" by default. One catalogue endpoint gets 3,600 an hour. Refgrow's is "100 requests per minute per API key". Endorsely's is "100 requests per minute per organization".

Let's say you sync commissions once a night for a program with a few thousand sales a month. None of these limits bites. Now let's say you poll every minute for live numbers on a screen. On impact.com's default you get about 17 calls a minute. One screen is fine. Ten are not. On Rewardful, 90 a minute. On the two 25-a-second APIs, the screen is not the constraint. Match the limit to how you will call it, not to the biggest number.

What can you write, and is it safe to retry?

In shortEvery one of them can read. The differences are on the write side. Whether you can record a sale from your own backend. Whether you can mark a refund or a churn. And whether a retried request creates a duplicate. Two references on the table promise it will not, in two different shapes.

AffiliateRail's rule is on its API overview. "An Idempotency-Key header on any POST replays the first response for 24 hours; the same key with a different request is a 422". So if your server times out and sends the same request again, nothing doubles. Its rate-limits page says to use it "on anything that must not happen twice: creating sales, partners, or payout batches". That is what makes a retry loop safe to write.

Refgrow's shape is a field, not a header. On its conversions endpoint, the reference field "also acts as an idempotency key. Sending the same reference twice returns the original conversion instead of creating a second one, so a retried webhook cannot pay an affiliate twice." Same promise, scoped to one endpoint. On the other nine, the pages fetched make no promise, so build the check yourself.

The write surface elsewhere. Reditus's affiliate program API has Create Payment, to "add payments for your referrals/leads", a v2 Track Conversion, a Churn Referral call, and Create Refund. That is the API its Paddle and Chargebee pages point at. Reditus has no connector for either. FirstPromoter's API page: "Our API allows you to track sales, refunds, upgrades and cancellations even if you have a billing provider we do not support." Endorsely's Track Referral "records a conversion from an affiliate referral", with an amount in cents. Refgrow's conversions endpoint is "to record conversions from your backend". Dub's can "track lead and sale events". PartnerStack has a Create a transaction call and a Convert a customer call.

Tolt's six main objects, partners, customers, links, commissions, transactions and promotion codes, each have list, retrieve, create, update and delete. Programs is list only. Clicks is create only. Transactions adds a refund. Tapfiliate's reference is wide on the write side. Create a conversion, add commissions to it, approve or disapprove a commission, create an affiliate, create a payment, and create a click.

Rewardful's resources are campaigns, affiliates, affiliate links, affiliate coupons, referrals, commissions and payouts. PartnerStack's reference leads with deals: create, update, assign a partnership, archive. Dub's Partners API covers partners, applications, tracking, customers, commissions, payouts and discount codes. AffiliateRail's page says the API can create sales, partners and payout batches.

Which ones publish a contract a machine can read?

In shortThree publish OpenAPI. AffiliateRail at /v1/openapi.json, generated from the running code. PartnerStack inside its llms.txt. Reditus as a set of OpenAPI specs in its index. Eight of the eleven carry an llms.txt index. Four name an MCP server: AffiliateRail, Dub, Refgrow, and FirstPromoter's, which it marks experimental.

The OpenAPI file is the practical one. AffiliateRail's page says the reference is generated from the OpenAPI document the API publishes, "so it cannot drift from the running product". Its clients page shows the pairing it uses itself. openapi-typescript for the types, openapi-fetch for the calls. The page calls it "a thin, fully typed fetch wrapper with no codegen beyond one .d.ts file". So a TypeScript app gets typed calls in minutes, from the same file the product runs on.

An MCP server is a service that lets an AI assistant use a product's tools in plain language. Claude and ChatGPT are two such assistants. AffiliateRail's has "seventeen read tools" across partners, customers, commissions, payouts and reports. It has "twelve guarded write tools". Before any write, "the server sends back a confirmation card". It shows names, amounts and a field-level list of what would change. And "nothing that moves money, mints credentials, deletes data or touches billing is exposed over MCP at all". Dub's integrations page names its MCP server, signed in through an OAuth app. Refgrow's docs list an MCP server under its API. FirstPromoter's list one too, marked "Experimental", with an "Available Tools" page.

The llms.txt files are for the same audience. Tolt, Rewardful, Reditus, PartnerStack, Dub, FirstPromoter and impact.com each carry one that indexes their docs for an assistant to read. AffiliateRail publishes four: the API index, a full-text version of every route, the webhook catalogue, and the docs suite. PartnerStack's adds a Markdown copy of each page. If you plan to have an assistant write your integration, check for that file first.

What about webhooks?

In shortNine of the eleven show them on the pages fetched. AffiliateRail signs every delivery with a Rail-Signature header and gives partners the same mechanism as postbacks. Rewardful's developer centre has a signed-webhooks section. FirstPromoter's v2 webhooks page covers delivery tracking and retries. Dub, PartnerStack, impact.com, Refgrow and Reditus list webhooks in their references. Tapfiliate offers an external webhook feature beside Zapier and Make.

AffiliateRail's page: "AffiliateRail sends a signed HTTP POST to your endpoint when something happens in your program". You add an endpoint under Settings, Webhooks, and tick the event types. The signature header carries a timestamp and a version-one hash. Your server can verify the message came from AffiliateRail, not from anyone who found the URL. The webhooks page has the event list.

Rewardful's reference has webhook endpoints, requests, event types and a signed-webhooks page. Tapfiliate's help centre says you can integrate "via Tapfiliate's external Webhook feature", or through Zapier or Make. Tolt's rate-limit page tells you to use webhook notifications instead of polling, so it has them, on a page I did not fetch. Endorsely may too. Absence from this page is not absence from the product.

Which one should you pick?

In shortFor a typed client from a live contract, AffiliateRail's OpenAPI file, generated from the running code. For a retry that cannot double, AffiliateRail's header on every POST, or Refgrow's reference field on conversions. For recording sales from a billing system nobody supports, Reditus's Payments API, FirstPromoter's tracking API, or Endorsely's Track Referral. For the widest SDK set, Dub. For volume, PartnerStack's 4,000 a minute, with the warning that going over it may get the IP address temporarily blocked.

The API is rarely the reason to choose a tool. It is the reason a tool becomes hard to leave. So before you build on one, read its limit, its write surface and its retry rule. Check whether you can export everything through it. The API integration page and the MCP page have AffiliateRail's in full. The Tolt and Dub pages cover the two with the closest developer surfaces.

Every figure on this page was read off the vendor's own API reference on the date beside it in the sources. Limits change with plans and over time. Read the reference before you build.

Common questions