Use API keys and webhooks

You can connect your backend to Anderro to report customer events and manage your affiliate program. API requests send instructions to Anderro. Outgoing webhooks notify your application when something changes. Choose the connection that fits the work you need to automate.

Keys

Each product has public and secret credentials. The public key identifies your product in the tracking snippet and may appear in your page HTML. Keep the secret key on your server. Use it in the x-api-key header for server-side tracking events and the product's Management API.

Live and test keys belong to separate environments. Test keys write sandbox data so you can check an integration without creating live earnings. Keep the browser snippet, server events, and webhook configuration in the same mode during a test. When moving to live, update each relevant connection deliberately.

Regenerating a key replaces the credential used by integrations. Update every caller that uses it and verify requests afterward. Tracking key lookups are cached briefly, so do not rely on an old key continuing to work during a transition. Never paste a secret key into a public page or send it to an affiliate.

Webhooks

Configure an outgoing webhook URL for your product and choose the events your application needs. Notifications cover supported affiliate, commission, and payout changes. Your endpoint receives a payload with an event ID, event name, creation time, and data. Sandbox notifications identify themselves as sandbox data.

Verify the signature with your outgoing webhook secret before accepting an event. That secret is separate from your API key and from a payment provider's incoming webhook signing secret. Keep these credentials clearly named in your server configuration.

Use the test action to check your endpoint, then inspect delivery history when troubleshooting. Deliveries may be retried after temporary failures. Handle repeated event IDs safely so a repeated notification does not repeat an action in your system.

Rotating the outgoing webhook secret replaces the previous value immediately. Prepare your receiver for the change, rotate the secret, install the new value, and verify a test delivery. There is no old-secret grace period to rely on.

Choose the right event flow

Send a server-side signup with the customer's email and visitor ID before a payment that needs email-based attribution. Browser-only payments are analytics and do not create commissions. Include your transaction's external ID so you can identify it when reporting a refund.

The Management API can manage affiliates, commissions, payouts, and refunds. Automating payout records still does not transfer money. You remain responsible for sending affiliate payments and recording their completion. Start with integration testing and verify each step before using live credentials.