Skip to main content
November 3, 2026
If a call to the Tapfiliate REST API comes back refused, the cause is usually one of three things, and they need different fixes. This guide helps you tell them apart before you change anything in your integration.
In this article we will go over:
  1. Where to find your API key
  2. How to send your API key
  3. Which problem do you have?
  4. A disabled team member’s key stops working
  5. What happens to rejected requests
  6. FAQ
  7. Next Steps

Where to find your API key

  1. In the bottom-left corner of your dashboard, click the circle with your initials.
  2. Select Profile settings.
  3. Scroll all the way down to the API key field. If there is no key there yet, click Generate API key.
⚠️ Generating a new key cannot be undone. The old key stops working straight away. Anything still using it – your own scripts, Zapier, webhooks, the MCP server – will stop working until you update it with the new key.
Each team member has their own key. Keep it private and do not put it anywhere others can see it, such as JavaScript on your website or a screenshot.

How to send your API key

The key goes in a request header named exactly X-Api-Key. It is not a bearer token and it is not a query parameter. All requests must use HTTPS.
Before you change anything else, make one call to the programs endpoint with the same key. If your programs come back, the key itself is fine and the problem is somewhere else. The exact header syntax is in How to Integrate with Tapfiliate via the REST API.

Which problem do you have?

Every endpoint is refused, including the programs endpoint

This usually means the request reached us without a recognised API key. Check that:
  1. The header is named exactly X-Api-Key.
  2. Nothing between your code and the API removes custom headers. A proxy, an API gateway or an HTTP client setting can strip them.
  3. Each person uses the key from their own Profile settings, not a colleague’s.

Only the click endpoints are refused

If listing clicks is refused while conversions, affiliates, commissions and balances all work, your key is fine. The two click-reading endpoints are part of Detailed API Click Reporting, which is available on the Enterprise plan only. An account without it is refused on those two endpoints only, and creating clicks through the API is not affected.

The key is sent but not accepted

This happens in one of three cases:
  • The key was regenerated, so the one in your integration is no longer current.
  • The team member the key belonged to was removed.
  • The team member the key belongs to has been disabled. See the next section.
Ask the person who owns the key to open Profile settings and compare the key shown there with the one in your integration. If the two do not match, the key was regenerated and your integration needs the current one.

A disabled team member’s key stops working

A key belongs to a person, not to the account. If that person’s team member user is set to Disabled, their key is refused even though it still looks valid.
  1. Go to Settings > Team members.
  2. Check that the user’s Status is Enabled. The Account Holder or an Admin can change it by clicking the status.
  3. Enabling a member needs a free seat on your plan. See How to Invite and Manage Team Members.
An alternative is to point the integration at the key of an active team member who has API/Zapier access.

What happens to rejected requests

💡 Rejected requests are not stored. Conversions sent while the key was being refused were never recorded on our side. Once the key works again, resend the conversions for the whole period the integration was failing – they will not appear on their own.
This is worth doing as soon as you fix the key, because the gap in your reporting will otherwise stay there. See Troubleshooting: Why is a Conversion Not Being Tracked?.

FAQ

❓Which endpoints can I use on my plan?

Reading programs, affiliates, conversions, commissions and balances through the API is included from the Launch plan upwards. The two click-listing endpoints are the exception described above: they are part of Detailed API Click Reporting, which is included in the Enterprise plan.

❓Why do I only get 25 records back?

Requests that return multiple items are paginated to 25 items by default. Use the ?page parameter to fetch the rest.

❓I have checked everything and it still fails. What should I send you?

Send us one full rejected request and its response: the time, the endpoint and the response body. Please leave the key itself out of the message.
Still need help?
If you have any questions or if something in this guide is unclear, please don’t hesitate to contact us at support@tapfiliate.com – we’re happy to assist!

Next Steps