API Reference

Base URL (prototype): https://maa-api-cccf50.fly.dev

All bodies are JSON. Times are epoch milliseconds. Money is integer USD cents.

Authentication

The SDK endpoints (/sdk/install, /sdk/identify) require your SDK key:

Authorization: Bearer pk_live_…

/clicks is open (it only logs a click for a known link). Dashboard read endpoints are unauthenticated in the prototype — don't expose them publicly yet.

POST /clicks

Logs a click and returns the link's destination (used by the link Worker). Raw IP is never sent — only a hash.

{
  "customerAppId": "cmqn…",
  "slug": "lumi",
  "ipHash": "…",
  "userAgent": "…",
  "claimToken": "uuid",
  "clickedAt": 1782000000000
}

→ 200 { "clickId": "…", "affiliateId": "…", "destinationUrl": "https://apps.apple.com/…" }

POST /sdk/install · auth

First-open / install. Provide a claimToken (Universal Link) or an affiliateCode (manual). On success the attributed affiliate is stored and returned.

{ "deviceId": "…", "claimToken": "uuid", "firstOpenAt": 1782000000000 }

→ 200 { "attributionId": "…", "affiliateId": "…" } · 401 invalid key · 404 no attributable click

POST /sdk/identify · auth

Binds your app's user id to the device's attribution.

{ "deviceId": "…", "customerUserId": "user_123", "identifiedAt": 1782000000000 }

→ 200 { "attributionId": "…", "customerUserId": "user_123" }

POST /webhooks/revenuecat/:customerAppId

RevenueCat posts here. Auth is the static Authorization token you configured (see Webhooks). Verifies → stores raw → normalizes → dedupes → attributes → writes a commission. Idempotent on (source, sourceEventId).

→ 200 { "eventId": "…", "commissionId": "…" | null } · 200 { "duplicate": true } · 401 bad token

GET /apps

→ 200 [{ "id": "…", "name": "…" }]

GET /apps/:appId/overview

Founder dashboard data: funnel (clicks/installs/identified/paid), revenueCents, commission totals (pending/matured/paid/lifetime), affiliates, links, recent commissions.

GET /apps/:appId/affiliates/:affiliateId/overview

Creator dashboard data, scoped to that affiliate: funnel, earnings totals, links, nextPayoutAt. A creator can only ever see their own data.

POST /apps/:appId/affiliates/:affiliateId/payouts/export

Matures due commissions, creates a payout, marks them paid, and returns a CSV download. Idempotent — re-exporting pays nothing.

→ 200 text/csv (payout_id,affiliate_id,affiliate_name,commission_id,amount_usd_cents,amount_usd,currency,event_id,occurred_at)