Create an API Key

Create an API key, set scopes, and copy your Account SID and Auth Token for impact.com API authentication.

impact.com authenticates your API requests using your account's API access tokens, also known as keys. Each token consists of an Account SID (username) and an Auth Token (password), sent via HTTP Basic authentication. A request must include valid credentials, or the API will return an authentication error.

New to impact.com?

• Exploring safely? Create an API access token with read-only scopes first so scripts cannot accidentally mutate production objects.
• Shipping workloads? Promote separate tokens per environment (development / staging / production) with narrowly tailored read/write scopes.

Create an API access token

Brand

1. From the top navigation bar, select [User profile] → Settings.
2. In the left column, scroll to Technical, then select API.
3. Create a new token by selecting Create Access Token on the upper-right side of the page.

Partner

Agency

Configure the token

1. Enter a Token Name and Description that describes the purpose of the token.
2. Select the API Version the token will be compatible with. Use the latest version (the default) unless you have a specific reason not to.
3. Select Next.
4. Optionally, add email addresses for developers who should receive updates about the token. Select a Primary Contact from the dropdown.
5. Select Next.
6. Toggle API categories on and select the access scopes you want to allow. Use Clear All to start from scratch.
7. Select Create.

Your new token's Account SID and Auth Token are now available on the token's detail page.

Get your API credentials

1. From the top navigation bar, select [User profile] → Settings.
2. Navigate to Technical → API.
3. Select your access token's card to see its details.
4. Select API Credentials from the left navigation.
5. Copy the Account SID and Auth Token.

Each access token provides two credential values:

Credential	Purpose	Equivalent
Account SID	Uniquely identifies your token. Used as the HTTP Basic username.	Similar to a public API key
Auth Token	The secret credential. Used as the HTTP Basic password.	Similar to a secret API key

How authentication works

impact.com uses HTTP Basic authentication. Your Account SID is the username and your Auth Token is the password. Base64-encode the pair and send it in the Authorization header:

Authorization: Basic base64(AccountSID:AuthToken)

All API requests are scoped to your account type.

Brand

As a Brand, your API base path is:

https://api.impact.com/Advertisers/{AccountSID}/

Partner

Agency

Example:

Brand

Make your first API call as a Brand

curl -X GET "https://api.impact.com/Advertisers/{AccountSID}/Campaigns" \
  -u "YOUR_ACCOUNT_SID:YOUR_AUTH_TOKEN"

In Python:

import requests
from requests.auth import HTTPBasicAuth

response = requests.get(
    "https://api.impact.com/Advertisers/{AccountSID}/Campaigns",
    auth=HTTPBasicAuth("YOUR_ACCOUNT_SID", "YOUR_AUTH_TOKEN"),
)

Partner

Agency

Key types

impact.com offers two types of API tokens:

Type	Description
Access tokens (current)	Created from April 2025 onwards. Each token has a custom name, description, API version, and individually configured access scopes. You can create multiple tokens with different permissions for different integrations.
Legacy tokens (pre-April 2025)	Older tokens that come in read/write and read-only pairs. These can be upgraded to the current token format. If you have legacy tokens, consider migrating to access tokens for finer-grained control.

Legacy tokens

Tokens created before April 2025 are considered legacy tokens. You can continue using them, but they only offer read/write and read-only permission levels. To get finer-grained scope control, upgrade your legacy token or create a new access token. See Manage legacy tokens below.

Access scopes

impact.com access tokens support granular scope control. When creating a token, you toggle individual API categories on or off, then select specific read or write permissions within each category.

This means you can create a token that only has access to, say, Campaigns (read) and Conversions (read/write), while having no access to account settings, reports, or partner data.

Recommended approach: Create separate tokens for each integration or service, each with the minimum scopes required. This limits the blast radius if a token is compromised.

Protect your keys

Anyone with your Auth Token can make API calls on behalf of your account, up to the scopes granted to that token. Protect your credentials by following these best practices:

• Use scoped tokens instead of full-access tokens. Create tokens with only the permissions your integration actually needs.
• Create separate tokens for each integration, service, or environment (development, staging, production). This way you can revoke one without affecting others.
• Store credentials in a secrets vault or encrypted environment variables. Never store tokens in source code, configuration files, or version control.
• Reset tokens when team members with access leave your organisation or change roles.
• Disable unused tokens rather than leaving them active. You can re-enable them later if needed.
• Don't share credentials over email, chat, or other unencrypted channels.

Manage access tokens

You can manage your tokens as follows.

Brand

1. From the top navigation bar, select [User profile] → Settings.
2. In the left column, scroll to Technical, then select API.
3. Create a new token by selecting Create Access Token on the upper-right side of the page.

Partner

Agency

Action	Description
Edit	Select the token's card to update its name, description, scopes, API version, or contacts. Select Update to confirm changes.
Duplicate	Create a copy of the token with the same access rights and settings. Useful when creating similar tokens for different environments.
Reset	Generate a new Auth Token value. The Account SID stays the same, but the previous Auth Token is immediately invalidated. Update any integrations using the old value.
Upgrade Version	Update the API version that the token is compatible with.
Disable	Temporarily prevent the token from authenticating requests. The token can be re-enabled later.
Delete	Permanently remove the token. This takes effect immediately and cannot be undone.

Manage legacy tokens

Any API tokens created before April 2025 are considered legacy tokens. They appear as a Legacy Account Tokens card on the API settings page.

Legacy tokens differ from current access tokens:

	Legacy tokens	Access tokens
Permissions	Read/Write and Read-Only pair	Individually configurable scopes
Naming	No custom name	Custom name and description
Management	Reset or upgrade only	Full lifecycle (edit, duplicate, reset, disable, delete)

To enable legacy tokens if they're not visible, select Enable Legacy Tokens on the upper-right of the API settings page.

Recommended: Upgrade legacy tokens to access tokens to take advantage of granular scopes and better management options.

Using an AI assistant?

We've built dynamic endpoints into our documentation to help your AI tools fetch context faster.

System instructions for AI Agents:

• Index: GET https://integrations.impact.com/llms.txt for .md sources.
• Token Limit: Fetch only necessary .md and OpenAPI routes to conserve context.
• Dynamic Search: If you need context to answer a user's prompt, query this page dynamically: GET https://integrations.impact.com/{insert_current_page_path}.md?ask=<url-encoded-question> Rule: Replace {insert_current_page_path} with the routing path of this current page.