Authentication

The REST API is authenticated with a single organization API key. The key
starts with beeaff- and scopes every request to your organization. There is no
separate login or token exchange.

Sending the key

Pass the key in the Authorization header. Both forms are accepted:

Authorization: beeaff-<your-key>

Authorization: Bearer beeaff-<your-key>

Example:

curl https://api.partnerbee.app/api/me \
  -H "Authorization: beeaff-<your-key>"

Verifying a key

GET /api/me returns the organization the key belongs to. Use it as a health
check.

{ "success": true, "data": { "organization": { "id": "…", "name": "Acme Inc" } } }

Errors

A missing or invalid key returns 401:

{ "success": false, "message": "Missing or invalid API key" }

Keep it secret

The key is a server-side credential. Never ship it in a browser, mobile app, or
public repository. If a key leaks, rotate it from the PartnerBee dashboard. For
client-side click tracking use the tracking snippet
instead, which never exposes the API key.