Authentication - SideShift

SideShift products use different credentials and base paths. They are not interchangeable - a Connect key cannot authenticate a Platform request, and a Platform OAuth token cannot call the Scraper API. All products share the host https://app.sideshift.app.

API	Status	Base path	Credential	Header
Platform — API key	Current	`/api/oauth/v1`	Scoped `sspk_…` key	`x-api-key`
Platform — OAuth	Current	`/api/oauth/v1`	OAuth 2.1 access token	`Authorization: Bearer …`
Legacy Platform API	Deprecated	`/api/v1`	Older company API key	`x-api-key`
Connect	Current	`/api/embed`	`sk_live_…` / `sk_test_…`	`x-api-key`
Scraper	Current	`/api/v1/scrape`	`scrape_live_…`	`x-api-key`

Current Platform authentication

Both current authentication methods call the same /api/oauth/v1 resource endpoints and use the same scopes, pagination, errors, idempotency, subscription checks, and rate limits.

Your own company

Create a scoped Platform API key. No redirects or token requests.

Other SideShift users

Scoped Platform API key

Use a Platform API key for your own scripts, scheduled jobs, backend services, and internal dashboards. Create it in Settings → Platform API & MCP → API keys, then send it only as:

GET /api/oauth/v1/campaigns HTTP/1.1
Host: app.sideshift.app
x-api-key: sspk_live_...

The sspk_ prefix and dedicated header let SideShift select the API-key verifier immediately; the server does not attempt OAuth first. Keys are bound to the selected company and may explicitly delegate direct agency children. Every request is limited by the saved key scopes and the creator’s current permissions; child requests also check current child access. See Team and integration permissions.

OAuth 2.1

Use OAuth authorization code with PKCE (S256) when your product connects another SideShift company. Every access token is bound to the connected company and scopes that user approved.

Task	URL
Discovery	`https://app.sideshift.app/.well-known/oauth-authorization-server`
Client registration	`https://app.sideshift.app/api/oauth/v1/register`
User authorization	`https://app.sideshift.app/api/oauth/v1/authorize`
Token exchange and refresh	`https://app.sideshift.app/api/oauth/v1/token`

Send access tokens as bearer tokens:

GET /api/oauth/v1/campaigns HTTP/1.1
Host: app.sideshift.app
Authorization: Bearer YOUR_ACCESS_TOKEN

Scopes split read from write - for example, campaigns:read and campaigns:write. Request the narrowest set your integration needs. Sensitive scopes are called out on the consent screen and in the reference.

Agency sub-account requests

An agency parent can delegate a scoped Platform API key or human OAuth/MCP grant to all direct sub-accounts (including ones created later) or an explicit current subset. Choose delegation when creating a key or approving OAuth consent. Each request still has exactly one effective company: omit the header to use the connected parent, or send X-Act-As-Company with a consented direct child’s company id. Use GET /companies with settings:read to resolve company ids rather than guessing them.

curl -sS "https://app.sideshift.app/api/oauth/v1/campaigns?limit=25" \
  -H "Authorization: Bearer $SIDESHIFT_ACCESS_TOKEN" \
  -H "X-Act-As-Company: $SIDESHIFT_SUBACCOUNT_ID"

const response = await fetch(
  "https://app.sideshift.app/api/oauth/v1/campaigns?limit=25",
  {
    headers: {
      Authorization: `Bearer ${process.env.SIDESHIFT_ACCESS_TOKEN}`,
      "X-Act-As-Company": process.env.SIDESHIFT_SUBACCOUNT_ID,
    },
  },
);

import os
import requests

response = requests.get(
    "https://app.sideshift.app/api/oauth/v1/campaigns",
    params={"limit": 25},
    headers={
        "Authorization": f"Bearer {os.environ['SIDESHIFT_ACCESS_TOKEN']}",
        "X-Act-As-Company": os.environ["SIDESHIFT_SUBACCOUNT_ID"],
    },
)

Delegation never chains beyond one direct child. The child relationship and subscription are checked live. For a delegated sspk_… key, use x-api-key instead of the Bearer header in these examples. Key scopes and delegation are selected at creation; OAuth/MCP delegation is chosen during consent. Company client_credentials tokens do not carry child delegation. See Agency access for setup, examples, and error recovery.

Undocumented query parameters such as companyId, company_id, company, client, and subaccountId are not general tenant selectors. A named parameter has an effect only where that endpoint explicitly documents it.

Legacy Platform API key

The API-key Platform API at /api/v1 is legacy, deprecated, and not maintained. Do not use it for new integrations. This section exists only to help maintain an integration while it migrates to OAuth.

Legacy integrations send the key created in Settings → Integrations on every request:

GET /api/v1/programs HTTP/1.1
Host: app.sideshift.app
x-api-key: YOUR_KEY

The frozen API-key surface is narrow and read-oriented. It does not receive new Platform features or maintenance fixes, and it does not support the full OAuth capability set.

Connect

A key created in Settings → Connect, sent as x-api-key. The key prefix selects the environment - sk_test_… routes to sandbox and sk_live_… to production, against the same base URL. There is no separate sandbox host.

Scraper

An independent key created in Scraper → API Keys, sent as x-api-key.

Click Create key.
Copy it immediately - the full value is shown only once.

Stored key previews in the dashboard are truncated and cannot be used to authenticate. If you lose a key, create a new one.

Rate limits and errors

Current Platform resource requests allow 600 requests per minute per credential and company, whether the credential is a scoped Platform API key or an OAuth client. Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset; a 429 also includes Retry-After. The deprecated Platform API-key surface returns these headers on every response: X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset.

100 requests per minute per API key
400 requests per minute for allowlisted partner accounts

Its errors use { "error": "<message>" }:

Status	Meaning
`400`	Invalid request
`401`	Invalid or missing key
`402`	No active subscription
`403`	Restricted endpoint or cross-company access
`404`	Not found
`429`	Rate limited

Current Platform resource errors (for both scoped API keys and OAuth) use { error: { code, message, requestId } }. Include requestId when contacting support. See the API-key quickstart errors for the most common fixes. Connect has its own per-endpoint limits - account creation 100/hour, token generation 30/min per account, transfers 60/min, general 100/min - returning 429 with a Retry-After header. See Connect. Scraper accounts default to 120 requests per minute across all endpoints, with optional account-specific limits. See Scraper billing, errors, and limits.

​Current Platform authentication

Your own company

Other SideShift users

​Scoped Platform API key

​OAuth 2.1

​Agency sub-account requests

​Legacy Platform API key

​Connect

​Scraper

​Rate limits and errors

Current Platform authentication

Scoped Platform API key

OAuth 2.1

Agency sub-account requests

Legacy Platform API key

Connect

Scraper

Rate limits and errors