Authentication
All Brand API requests go to:
https://app.partnerboost.com/api/brand
Methods: HTTPS GET or POST with JSON body (POST recommended for actions with payloads).
Get your credentials
Log in to the Brand dashboard, then copy credentials from these pages:
| Credential | Where to get it |
|---|---|
bid | Brand Info |
token / secret | API credentials |
Brand login
If you are not logged in, open Brand Login first, then open the pages above.
Required parameters
Include these in the query string or JSON body:
| Parameter | Description |
|---|---|
bid | Brand Id from Brand Info |
token | API token from API credentials |
action | API action (e.g., order/new) |
version | API version — currently 1.0 |
Required headers
| Header | Value |
|---|---|
Content-Type | application/json |
X-PARTNERBOOST-DATE | Current UTC time, e.g. Mon, 27 Jul 2026 07:21:16 GMT |
X-PARTNERBOOST-AUTHENTICATION | SHA-256 hex digest (see below) |
Authentication hash
Compute SHA-256 (64-character lowercase hex) over:
{token};{action};{utcDate};{secret}
Example inputs (do not use in production):
| Field | Example value |
|---|---|
| token | a25fb1225425ae360ec2922286e7bd01 |
| action | order/new |
| utcDate | Fri, 07 Jan 2022 07:21:16 GMT |
| secret | 65906f8ecdaf1147bca07dbebf9d29656317a2913783b6ac6f08c6d5713dca5c |
String to hash:
a25fb1225425ae360ec2922286e7bd01;order/new;Fri, 07 Jan 2022 07:21:16 GMT;65906f8ecdaf1147bca07dbebf9d29656317a2913783b6ac6f08c6d5713dca5c
Expected header:
X-PARTNERBOOST-AUTHENTICATION: c0603ea2f4bd66eaac5e6fbbd2093ea6426d7e13e0a8cc4f5550368f55f7e64a
Sample code (Python)
import hashlib
from datetime import datetime, timezone
from email.utils import format_datetime
token = "YOUR_TOKEN"
secret = "YOUR_SECRET"
action = "order/new"
utc_date = format_datetime(datetime.now(timezone.utc), usegmt=True)
raw = f"{token};{action};{utc_date};{secret}"
auth_hash = hashlib.sha256(raw.encode()).hexdigest()
headers = {
"Content-Type": "application/json",
"X-PARTNERBOOST-DATE": utc_date,
"X-PARTNERBOOST-AUTHENTICATION": auth_hash,
}
Clock skew
The UTC date in the header must match the string used in the hash. Large clock drift causes authentication failures — sync server time with NTP.
Response codes
{ "code": 0, "msg": "success", "data": {} }
Non-zero code indicates auth or validation errors. Check msg for details.
Next steps
Brand-only
Partner integrations use a different endpoint and token-only auth. See Partner API authentication.