Developer API & webhooks

Manage affiliates, read stats, report conversions from a headless or custom storefront, and receive signed event webhooks. Available on the Scale plan.

Authentication

Create an API key in the app under Developer. Send it as a bearer token. Keys are scoped to your store; the secret is shown once.

Authorization: Bearer ovr_live_xxxxxxxx
Base URL: https://overrideaff.com/api/v1

List affiliates

curl https://overrideaff.com/api/v1/affiliates?status=APPROVED&limit=100 \
  -H "Authorization: Bearer ovr_live_xxxxxxxx"

{ "data": [ { "id": "...", "name": "Jane", "email": "[email protected]",
  "referralCode": "JANE", "discountCode": "JANE10", "status": "APPROVED" } ],
  "count": 1 }

Program stats

curl https://overrideaff.com/api/v1/stats?days=30 \
  -H "Authorization: Bearer ovr_live_xxxxxxxx"

{ "data": { "currency": "USD", "affiliateDrivenRevenue": 12480, "conversions": 84,
  "clicks": 1902, "commissionsApproved": 940, "affiliates": 37 } }

Report a conversion (headless / custom checkout)

Report a sale server-to-server. Idempotent by orderId. Pass the affiliate's referralCode as ref. Optionally include customerId for recurring linkage — it's hashed, never stored.

curl -X POST https://overrideaff.com/api/v1/conversions \
  -H "Authorization: Bearer ovr_live_xxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{ "orderId": "1042", "amount": 149.00, "currency": "USD",
        "ref": "JANE", "customerId": "cust_88", "occurredAt": "2026-06-05T10:00:00Z" }'

{ "ok": true, "attributed": true, "conversionId": "...", "commissions": 2 }

Webhooks

Add an HTTPS endpoint under Developer and pick events. We POST a signed JSON body. Verify the signature with your endpoint's secret.

POST your endpoint
X-Override-Event: conversion.created
X-Override-Signature: <hmac-sha256(body, secret)>

{ "event": "conversion.created", "createdAt": "2026-06-05T10:00:01Z",
  "data": { "conversionId": "...", "affiliateId": "...", "subtotal": 149,
            "currency": "USD", "attributedBy": "ref_attribute", "commissions": 2 } }

Events: conversion.created, payout.paid, affiliate.created.

Verify in Node:

import crypto from "node:crypto";
const sig = crypto.createHmac("sha256", SECRET).update(rawBody).digest("hex");
if (sig !== req.headers["x-override-signature"]) reject();