Authentication overview

WeCanTrack provides authentication mechanisms primarily for its API, allowing programmatic interaction with its affiliate tracking and conversion data. The platform emphasizes no-code integrations for many common affiliate networks and analytics tools, but API access is available for users on higher-tier plans who require custom data retrieval or integration solutions. Proper authentication is critical to secure sensitive marketing performance data and ensure that only authorized applications can access or modify your WeCanTrack account information.

The core principle of WeCanTrack's API authentication revolves around identifying and verifying the legitimacy of a client application or user requesting access to resources. This process ensures data integrity and confidentiality, aligning with modern API security practices. WeCanTrack's approach is designed to be straightforward for developers while maintaining a robust security posture against unauthorized access attempts. For detailed information on API capabilities, refer to the official WeCanTrack documentation.

Supported authentication methods

WeCanTrack's API primarily utilizes API keys for secure access. This method involves generating a unique, secret key within the WeCanTrack dashboard, which is then included in API requests to authenticate the calling client. API keys are a common authentication mechanism for APIs due to their simplicity and effectiveness in identifying the calling application or user programmatically. They are suitable for server-to-server communication and applications where the client can securely store the key.

While API keys are the primary method, it's important to understand their role within the broader context of API security. API keys function as a token that grants access to specific resources or functionalities. Unlike more complex protocols like OAuth 2.0, API keys do not typically handle user authorization or scopes directly but rather identify the client making the request. For a comprehensive understanding of various API authentication techniques, the IETF's Bearer Token Usage documentation provides foundational insights into token-based authentication, which API keys often resemble in practice.

Authentication methods table

Method When to Use Security Level
API Key Programmatic access for custom integrations, data retrieval, server-to-server communication. Moderate (Requires secure storage and transmission, relies on client confidentiality).

Getting your credentials

To obtain your API key for WeCanTrack, you will typically navigate to the API settings or developer section within your WeCanTrack account dashboard. This process usually involves generating a new key, which will be displayed once. It is crucial to copy and store this key securely immediately after generation, as it may not be retrievable later for security reasons. If a key is lost or compromised, it should be revoked and a new one generated.

The exact steps for generating an API key are as follows (these steps are general and may vary slightly based on UI updates):

  1. Log in to your WeCanTrack account.
  2. Navigate to the 'Settings' or 'Profile' section.
  3. Look for an 'API Access', 'Developer', or 'Integrations' tab.
  4. Locate the option to 'Generate API Key' or 'Create New Key'.
  5. Follow any on-screen prompts to confirm the generation.
  6. Copy the displayed API key.

It is important to note that API access is often restricted to specific subscription tiers. If you do not see the option to generate an API key, verify your current subscription plan on the WeCanTrack pricing page or contact WeCanTrack support for assistance. Once generated, your API key acts as a secret token; treat it with the same level of confidentiality as a password.

Authenticated request example

When making API requests to WeCanTrack, your API key must be included in the request headers. This is a standard practice for API key authentication, ensuring that each request is properly authorized. Typically, the API key is passed in an Authorization header using a Bearer token scheme, or in a custom header specified by the API documentation. Always consult the specific WeCanTrack API documentation for the exact header name and format required.

Below is a conceptual example using curl to demonstrate how an API key might be included in a request to a hypothetical WeCanTrack endpoint. Replace YOUR_API_KEY with your actual generated key and https://api.wecantrack.com/v1/data with the actual API endpoint you intend to query.


curl -X GET \
  'https://api.wecantrack.com/v1/data' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer YOUR_API_KEY'

In this example:

  • -X GET specifies the HTTP method (GET for retrieving data).
  • 'https://api.wecantrack.com/v1/data' is the API endpoint.
  • -H 'Accept: application/json' indicates that the client expects a JSON response.
  • -H 'Authorization: Bearer YOUR_API_KEY' is the crucial part for authentication, where Bearer is the token type and YOUR_API_KEY is your secret credential.

Always ensure that your API key is transmitted over HTTPS (HTTP Secure) to prevent interception. All WeCanTrack API endpoints should enforce HTTPS, protecting your credentials during transit. Failure to use HTTPS can expose your API key to man-in-the-middle attacks, compromising your account security.

Security best practices

Securing your WeCanTrack API keys and integrations is paramount to protecting your sensitive affiliate marketing data. Implementing robust security practices helps prevent unauthorized access, data breaches, and potential misuse of your account. Adhering to these guidelines ensures the confidentiality and integrity of your tracking information.

Key management and storage

  • Secure Storage: Never hardcode API keys directly into client-side code (e.g., JavaScript in a browser). Store them in environment variables, secret management services, or secure configuration files on your server. For cloud deployments, consider services like AWS Secrets Manager or Google Secret Manager for secure credential storage (Google Cloud Secret Manager documentation).
  • Access Control: Restrict access to API keys to only those individuals and systems that absolutely require them. Implement role-based access control (RBAC) to limit who can view or modify API credentials.
  • Rotation: Regularly rotate your API keys. This practice limits the window of exposure if a key is compromised. WeCanTrack's dashboard should provide functionality to revoke old keys and generate new ones.
  • Avoid Public Repositories: Never commit API keys or configuration files containing them to public version control repositories like GitHub. Use .gitignore files to exclude sensitive data.

Transmission security

  • HTTPS/TLS Enforcement: Always ensure that all API requests to WeCanTrack are made over HTTPS (HTTP Secure). This encrypts the communication channel, protecting your API keys and data from interception during transit. WeCanTrack's API endpoints are designed to enforce HTTPS.
  • Network Security: If possible, restrict API access to specific IP addresses or networks using firewall rules. This adds an extra layer of security by ensuring that requests can only originate from trusted environments.

Monitoring and logging

  • Monitor API Usage: Regularly review API usage logs provided by WeCanTrack (if available) or your own integration logs. Look for unusual patterns, high volumes of requests from unexpected locations, or failed authentication attempts, which could indicate a compromise.
  • Alerting: Set up alerts for suspicious API activity, such as a sudden increase in error rates or access from new geographical regions.

Application security

  • Least Privilege: Design your applications to operate with the minimum necessary permissions. If WeCanTrack offers granular API key permissions, configure keys to only access the specific data or functionalities required by the application.
  • Error Handling: Implement robust error handling in your application. Avoid verbose error messages that might expose sensitive information about your system or API keys to potential attackers.

By diligently applying these security best practices, you can significantly mitigate risks associated with API key management and maintain a secure environment for your WeCanTrack integrations.