Skip to main content
Each SideShift API issues its own credential and has its own base path. They are not interchangeable — a Connect key will not authenticate a Platform request. All four share the host https://app.sideshift.app.

​
Platform — API key

A key created in Settings → Integrations, sent on every request.
Platform access requires an active SideShift subscription. Requests from a company without one return 402 { "error": "Active subscription required" }.
The published API-key surface is read-oriented — 24 operations, of which 5 write (export posts, create a program invite, and create/send/void invoices). Restricted endpoints such as Jobs, Applicants, and payout execution are not part of this spec; they live in a separate Full Access spec available to allowlisted partner accounts.

​
Platform — OAuth 2.1

OAuth 2.1 authorization code flow with PKCE (S256). Access tokens are bound to a single tenant (company_id) and carry only the scopes you request. Send them as Authorization: Bearer <token>. Scopes are granular and split read from write — for example campaigns:read and campaigns:write, payouts:read and payouts:write. Request the narrowest set your integration needs; payouts:write and settings:write are flagged sensitive in the spec because they move money and change company configuration. The full scope list is on the OAuth reference.

​
Connect

A key created in Settings → Connect, sent as x-api-key. The key prefix selects the environment — sk_test_… routes to sandbox and sk_live_… to production, against the same base URL. There is no separate sandbox host.

​
Scraper

An independent key created in Scraper → API Keys, sent as x-api-key.
  1. Click Create key.
  2. Copy it immediately — the full value is shown only once.
Stored key previews in the dashboard are truncated and cannot be used to authenticate. If you lose a key, create a new one.

​
Rate limits and errors

Platform API-key limits, returned on every response as X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset:
  • 100 requests per minute per API key
  • 400 requests per minute for allowlisted partner accounts
Errors come back as { "error": "<message>" }. Some endpoints add a code, such as LEAD_NOT_FOUND.
This error shape is specific to the Platform API-key surface. OAuth uses a structured envelope instead — { error: { code, message, requestId } } — and quotes the requestId for support. See Platform API.
Connect has its own per-endpoint limits — account creation 100/hour, token generation 30/min per account, transfers 60/min, general 100/min — returning 429 with a Retry-After header. See Connect.
Scraper rate limits are documented in its own specification, which is currently being revised. That section will be added once the revision lands.