Send your key
Every request to https://app.distribution.tech/api/v1 and to the MCP server at https://app.distribution.tech/api/mcp carries an API key:
curl https://app.distribution.tech/api/v1/campaigns \
-H "Authorization: Bearer $DISTRIBUTION_API_KEY"
A request with no key, an unknown key or a revoked key is refused with 401 unauthorized. Keys are created, rotated and revoked in your workspace under Developers. A key is shown once when it is created; the workspace keeps only its prefix.
Scopes decide what a key reaches
Each key carries scopes, one per kind of read and two for writes. A call outside the key's scopes is refused with 403 forbidden, and over MCP the tool is not listed for that key at all. The full list is on Scopes.
Mandates decide what a key may spend
A key with campaigns:write or plans:approve acts only inside the mandate the brand sets on it in Developers: the most a plan may total, a monthly cap, the channels, whether it may sign, an expiry, and the brand terms a person accepted for it. A write outside the mandate is refused before any spend with 403 mandate_refused, the limit, how much over, and escalate: true. Take that to a person at the brand; retrying does not help.
Idempotency keys make writes safe to retry
Every request that starts, changes or signs a campaign or plan takes an Idempotency-Key header (over MCP, an idempotency_key argument): 8 to 128 characters of letters, digits, dot, underscore, colon or hyphen. A retry with the same key and the same body returns the first answer and never runs twice. The same key with a different body is refused with 409 idempotency_conflict, and a retry while the first request is still running answers 409 in_progress with Retry-After.
Limits
One key makes up to 60 requests in a fixed 60-second window; RateLimit-Remaining and RateLimit-Reset count it down, and past it the answer is 429 rate_limited with Retry-After. A brand starts up to 3 new campaigns in any 24 hours. Creator reads have their own limits, listed on GET /creators.
Request ids
Every response carries an x-request-id header. Send your own (8 to 128 letters, digits or . _ : -) and it is echoed back. Quote it when you report a slow or failed call.