Skip to main content

Authentication

All Brand API requests go to:

https://app.partnerboost.com/api/brand

Methods: HTTPS GET or POST. Use POST when sending a JSON payload (recommended for actions with fields beyond routing params).

Request shape​

Every call uses the same URL with routing parameters in the query string, plus optional action fields in the JSON body (POST) or query string (GET):

POST https://app.partnerboost.com/api/brand?bid=…&token=…&action=…&version=1.0
Content-Type: application/json
X-PARTNERBOOST-DATE: …
X-PARTNERBOOST-AUTHENTICATION: …

{ …action-specific fields… }
Query string is required for routing params

bid, token, action, and version must appear in the query string. If you put them only in the JSON body, the server returns HTTP 404 with an empty body — not a JSON auth error.

Get your credentials​

Log in to the Brand dashboard, then copy credentials from these pages:

CredentialWhere to get it
bidBrand Info
token / secretAPI credentials
Brand login

If you are not logged in, open Brand Login first, then open the pages above.

Required parameters (query string)​

Include these in the query string on every request:

ParameterDescription
bidBrand Id from Brand Info
tokenAPI token from API credentials
actionAPI action (e.g., order/new)
versionAPI version — currently 1.0

Action-specific fields (order fields, report filters, etc.) go in the JSON body for POST requests, or in the query string for GET.

Required headers​

HeaderValue
Content-Typeapplication/json
X-PARTNERBOOST-DATECurrent UTC time, e.g. Mon, 27 Jul 2026 07:21:16 GMT
X-PARTNERBOOST-AUTHENTICATIONSHA-256 hex digest (see below)

Authentication hash​

Compute SHA-256 (64-character lowercase hex) over:

{token};{action};{utcDate};{secret}

Fictional example inputs (placeholders only — not real credentials):

FieldExample value
tokendeadbeefdeadbeefdeadbeefdeadbeef
actionorder/new
utcDateFri, 07 Jan 2022 07:21:16 GMT
secretcafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe

String to hash:

deadbeefdeadbeefdeadbeefdeadbeef;order/new;Fri, 07 Jan 2022 07:21:16 GMT;cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe

Expected header (SHA-256 of the string above):

X-PARTNERBOOST-AUTHENTICATION: 2574c43ca325825ea274ea6183cb188cd3dcd0863c0b756d300c388e63c6a7e4

Sample request (curl)​

Read-only connectivity check with report/order_list:

BID="YOUR_BID"
TOKEN="YOUR_TOKEN"
SECRET="YOUR_SECRET"
ACTION="report/order_list"
UTC_DATE="$(date -u '+%a, %d %b %Y %H:%M:%S GMT')"
AUTH_HASH="$(printf '%s' "${TOKEN};${ACTION};${UTC_DATE};${SECRET}" | shasum -a 256 | awk '{print $1}')"

curl -X POST "https://app.partnerboost.com/api/brand?bid=${BID}&token=${TOKEN}&action=${ACTION}&version=1.0" \
  -H "Content-Type: application/json" \
  -H "X-PARTNERBOOST-DATE: ${UTC_DATE}" \
  -H "X-PARTNERBOOST-AUTHENTICATION: ${AUTH_HASH}" \
  -d '{"page_size": 1}'

Sample code (Python)​

import hashlib
from datetime import datetime, timezone
from email.utils import format_datetime
from urllib.parse import urlencode

import requests

bid = "YOUR_BID"
token = "YOUR_TOKEN"
secret = "YOUR_SECRET"
action = "report/order_list"
utc_date = format_datetime(datetime.now(timezone.utc), usegmt=True)

raw = f"{token};{action};{utc_date};{secret}"
auth_hash = hashlib.sha256(raw.encode()).hexdigest()

query = urlencode({"bid": bid, "token": token, "action": action, "version": "1.0"})
url = f"https://app.partnerboost.com/api/brand?{query}"

headers = {
    "Content-Type": "application/json",
    "X-PARTNERBOOST-DATE": utc_date,
    "X-PARTNERBOOST-AUTHENTICATION": auth_hash,
}

payload = {"page_size": 1}
response = requests.post(url, headers=headers, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Clock skew​

The UTC date in the header must match the string used in the hash. Large clock drift causes authentication failures — sync server time with NTP.

Response codes​

{ "code": 0, "msg": "success", "data": {} }

Non-zero code indicates auth or validation errors. Check msg for details.

Next steps​

Brand-only

Partner integrations use a different endpoint and token-only auth. See Partner API authentication.