Step 1 · Login

Login is the first thing you can do, and it works as soon as you have your staging credentials. Your backend authenticates and receives an access token, which you later use to launch the affiliate system.

Login is not gated: it returns a valid token immediately, even before your webhooks pass QA. Opening the affiliate system (the iframe) is a separate step that stays gated until QA passes — see the Integration overview for the full order.

The endpoint

POST {monolith_base_url}/api/v4/affiliates/login/
Content-Type: application/json

Request body:

{
    "username": "<affiliate_username>",
    "password": "<affiliate_password>",
    "affiliate_point_of_sale_id": 2
}

Field	Type	Description
username	string	The username from the credentials we provide.
password	string	The password from the credentials we provide.
affiliate_point_of_sale_id	integer	The point-of-sale identifier for the login.

Success response

On success you receive 201 Created with the access token:

{
    "status": 201,
    "access_token": "<JWT>"
}

The access_token is a JWT valid for about 15 minutes. When it expires, simply call the login endpoint again to obtain a new one — there is no refresh endpoint. Because the token is short-lived, request a fresh one when you need it, for example right before launching the system.

Errors

If the affiliate_point_of_sale_id you send doesn't exist or isn't assigned to your client, you receive 404 Not Found:

{
    "status": 404,
    "message": "El Punto de Venta no existe o no esta asignada al cliente enviado. Favor de contactar al administrador del sistema.[1018]"
}

This message is returned by the API exactly as shown (in Spanish). It means the affiliate_point_of_sale_id in your request could not be matched to a point of sale assigned to your client. Check that you're sending the affiliate_point_of_sale_id we provided with your credentials; if it still fails, contact us.

Next step

Use the access_token from a successful login to launch the affiliate system. See Step 3 · Launch the system for how the token is used.