Authentication

All API requests require an API key passed via the Authorization header as a Bearer token.

API Keys

Authorization: Bearer rk_xxxxx

API keys are generated per app from the dashboard. Each app has a single API key that identifies the app. Keep your API key secure — never expose it in client-side code.

Use environment variables:

const INCENTA_API_KEY = process.env.INCENTA_API_KEY

Then include it in requests:

const res = await fetch('https://incenta.dev/api/v1/referrals', {
  headers: {
    Authorization: `Bearer ${process.env.INCENTA_API_KEY}`
  }
})

Key prefixes

Rate limiting

API usage is tracked per app via ApiUsageLog. Each app has a monthly limit configured in the dashboard. When exceeded, the API returns a 429 Too Many Requests response.

Errors

The API uses conventional HTTP response codes:

Error responses include a message:

{
  "error": "Referral code not found"
}