Public API

Authentication

Server-to-server only. Use a brand API key, never a user access JWT from pactreach.com login.

Headers

Send the key on every request except first-key bootstrap.

  • Preferred: X-Api-Key: pr_live_...
  • Also accepted: Authorization: Bearer pr_live_...

Keys always start with pr_. Anything else returns UNAUTHORIZED. The key must belong to the brandId in the URL or the request is FORBIDDEN.

curl -sS 'https://api.pactreach.com/api/v1/brand/{brandId}/api-key/fetch-keys' \
  -H 'X-Api-Key: pr_live_...'

Scopes

  • read - list keys, webhooks, deliveries, campaigns, deals, tracked links, placements, escrow, conversions, workspace, and send a test ping
  • write - mint or revoke keys, register / update / delete webhooks, rotate the webhook signing secret

If you omit scopes when creating a key, PactReach stores ["read"] only. Conversion postbacks accept any valid key for that brand (read or write) plus Idempotency-Key.

Billing advertises Growth as read and Scale or Agency as full. The live public API checks key scope, not the current plan, on each request. See pricing.

Bootstrap token

POST /brand/:brandId/api-key/create-key does not accept an API key. It requires X-PactReach-Bootstrap-Token (or Bearer with that token). PactReach Support issues the token for your workspace. It is not the API secret. Use it for the first key, and for recovery if every key was revoked. Otherwise prefer rotate-key.

curl -sS -X POST 'https://api.pactreach.com/api/v1/brand/{brandId}/api-key/create-key' \
  -H 'Content-Type: application/json' \
  -H 'X-PactReach-Bootstrap-Token: ...' \
  -d '{"name":"Production","scopes":["read","write"]}'

Response data.secret is shown once. Store it in your secrets manager. Listing keys later returns only keyPrefix, scopes, and last used time.

Additional keys

POST /brand/:brandId/api-key/rotate-key mints a new key. It does not revoke the caller. Switch traffic, then DELETE /brand/:brandId/api-key/:keyId/revoke-key. Revoke is immediate.

curl -sS -X POST 'https://api.pactreach.com/api/v1/brand/{brandId}/api-key/rotate-key' \
  -H 'Content-Type: application/json' \
  -H 'X-Api-Key: pr_live_...' \
  -d '{"name":"Production-2026-08","scopes":["read","write"]}'

What not to send

  • Website or Studio access tokens
  • Refresh cookies
  • Creator credentials
  • The webhook signing secret as an API key

Next: verify webhooks or endpoint reference.