> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firstpromoter.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate your API

## Authentication

### Obtaining Your Credentials

The Affiliate API uses two credentials to authorize requests:

1. **Access Token**: An OAuth2 bearer token tied to the affiliate's session
2. **Account ID**: Identifies the FirstPromoter company account

There is currently no UI to retrieve these credentials directly. The easiest way to obtain them is via your browser's **Network tab** while logged into the affiliate dashboard:

1. Log in to the affiliate dashboard
2. Open your browser's DevTools (F12 or right-click → Inspect) and go to the **Network** tab
3. Reload the page or perform any action to trigger an API request
4. Click on any request to `api.fprom.io`
5. Under **Request Headers**, you will find:
   * `Authorization: Bearer {your_access_token}`

Copy the access token and store it securely.

To get your **Account ID**, check for a request to the `/me` endpoint using your access token and look for the `cid` field in the response:

The `cid` value inside the `company` object in the response is your Account ID.

<Warning>
  The access token is tied to the affiliate's session and will expire when the session ends or the user logs out. You will need to retrieve a new token each time.
</Warning>

### Making Authenticated Requests

All API requests must include both credentials in your request headers:

```
Authorization: Bearer {your_access_token}
ACCOUNT-ID: {your_account_id}
```

#### Example Request

```
GET https://api.firstpromoter.com/api/v2/affiliate/campaigns
Authorization: Bearer 01234567890abcdef
ACCOUNT-ID: 123456
```

<Note>
  Replace `{your_access_token}` with the bearer token from the Network tab and `{your_account_id}` with the account ID found in the same request headers.
</Note>

### Security Best Practices

* Never expose your access token in client-side code or public repositories
* Use HTTPS for all API communications
* Retrieve a fresh token if requests start returning `401 Unauthorized`