Connect Claude or ChatGPT
Add the AffiliateRail MCP server to your assistant in about two minutes.
Run your affiliate program from your assistant instead of the dashboard: who your top partners are this month, which commissions and applications are waiting, who has gone quiet, how revenue is trending, why a payout failed. With a write key it can also decide applications, resolve risk flags, manage the resources shelf and send the campaigns you built. Takes about two minutes.
Server URL: https://mcp.affiliaterail.com/mcp
Requires: an AffiliateRail account. API and MCP access is part of every plan, the free trial included.
How the connection is secured
You never paste a master key into an assistant. When you add the server, the assistant opens an AffiliateRail sign-in page and asks for an API key. That key:
- is scoped: a read-only key answers questions and cannot change anything. Only a key with the write scope opens the write tools: commission and application decisions, partner invites, risk-flag resolution, the resources shelf and campaign sends;
- is checked once. The assistant receives a short-lived token (one hour, refreshed automatically) rather than the key itself;
- is revocable in one click: revoke the key under Settings → API keys and every assistant that used it is disconnected immediately.
Clients that can send a header directly (Claude Code, Cursor, mcp-remote) can skip the sign-in
page and send Authorization: Bearer rail_live_… instead. Same scopes, same revocation.
1. Create an API key
- In AffiliateRail, open Settings → API keys.
- Click New key, name it after the assistant ("Claude", "ChatGPT"), and pick the scope. Read is enough for questions and is the right default. Add write only if you want the assistant to be able to act: decide commissions and applications, invite partners, resolve risk flags, manage resources and send campaigns.
- Copy the key. It is shown once.
2a. Connect from Claude
- Go to claude.ai → Settings → Connectors → Add custom connector.
- Name:
AffiliateRail. Server URL:https://mcp.affiliaterail.com/mcp. Leave the OAuth client fields empty; the server registers the connector itself. Click Add. - Click Connect. An AffiliateRail page opens: paste the API key and click Connect. You are sent back to Claude.
- Under the connector, set the permissions for each tool. Our recommendation: leave the read
tools on Always allow and keep every write tool (
approve_commission,send_campaign,reject_applicationand the rest) on Needs approval, so you confirm every change before it happens. - In a new chat, make sure the AffiliateRail toggle is on under the tools menu, then ask.
Claude Desktop and Claude Code use the same URL. In Claude Code:
claude mcp add --transport http affiliaterail https://mcp.affiliaterail.com/mcpIt opens the same sign-in page on first use. To skip it with a key:
claude mcp add --transport http affiliaterail https://mcp.affiliaterail.com/mcp --header "Authorization: Bearer rail_live_…"
2b. Connect from ChatGPT
- Go to chatgpt.com → Settings → Apps → Advanced settings and switch Developer mode on.
- Click Create app. Name:
AffiliateRail. MCP server URL:https://mcp.affiliaterail.com/mcp. Authentication: OAuth. Tick the acknowledgement and click Create. - ChatGPT opens the AffiliateRail sign-in page: paste the API key and click Connect.
- In a chat, open the tools menu, enable AffiliateRail, and ask.
ChatGPT asks for confirmation before running a tool that changes data. Keep that on.
What you can ask
| Ask | Tool behind it |
|---|---|
| "Who are my top partners this quarter?" | top_partners(period) |
| "What commissions are waiting for approval over $50?" | pending_commissions(min_amount) |
| "Which partners have gone quiet in the last 60 days?" | idle_partners(days) |
| "Show me affiliate revenue by month this year" | revenue_by_period(granularity) |
| "Tell me everything about @jimi" | partner_detail(handle_or_email) |
| "Did last month's payouts go through?" | payout_status(period) |
| "What commission rules do I have?" | flows_summary() |
| "What referrals came in today?" | recent_referrals(limit) |
| "Find the partner whose email starts jane@" | list_partners(query, status) |
| "Which customers did @jimi bring in?" | list_customers(query, status) |
| "Show rejected commissions this month" | list_commissions(status, partner_handle) |
| "Who applied, and is anything held?" | list_applications() |
| "Revenue by product this quarter" | report(dimension, from, to) |
| "Any open fraud flags?" | list_risk_flags(status) |
| "What is on the resources shelf?" | list_resources() |
| "Is the newsletter still sending?" | messaging_status() |
With a write key:
| Ask | Tool behind it |
|---|---|
| "Approve commission com_…" | approve_commission(id) |
| "Reject com_… because it was a self-referral" | reject_commission(id, reason) |
| "Invite jane@example.com to the Agencies group" | invite_partner(email, group) |
| "Approve that application" | approve_application(application_id) |
| "Decline it, audience is not a fit" | reject_application(application_id, reason) |
| "Close the fraud flag, it was one bulk refund" | resolve_risk_flag(risk_flag_id, note) |
| "Add the brand kit link to resources" | create_resource_link(title, url) |
| "Unpublish the old one-pager" | update_resource(resource_id, published) |
| "Delete the outdated banner" | delete_resource(resource_id) |
| "Send the August campaign now" | send_campaign(campaign_id) |
| "Pause the welcome sequence" | pause_sequence(sequence_id) |
Every change made through an assistant is written to the audit log as mcp, with the key that
made it, and shows in the object's history like any other change. What is NOT here, on purpose,
whatever key the assistant holds: executing or approving payout batches, payout connections and
bank details, API keys and webhook secrets, billing, team roles, and deleting partners or
customers. Those stay in the dashboard.
Two resources are also exposed: program://current (your program's settings, plan and counts,
and the list of programs if you have more than one) and catalog://events (the webhook event
catalogue, the same one as docs/webhooks.md).
Amounts come back as integer minor units (cents, pence) with the currency and a formatted string. The assistant is told to quote the formatted one.
More than one program
Keys belong to your organization, so one key covers every program on it. Tools default to your
first program; say which one you mean ("in the Acme Partners program") and the assistant passes
its program_id, which it reads from program://current.
Disconnecting
Revoke the key under Settings → API keys. The connector stops working on its next request. Removing the connector in Claude or ChatGPT without revoking the key leaves the key valid, so revoke too.
For developers
- Endpoint:
POST https://mcp.affiliaterail.com/mcp, streamable HTTP, stateless, JSON responses. - Discovery:
/.well-known/oauth-protected-resourceand/.well-known/oauth-authorization-server. - OAuth 2.1: dynamic client registration (
/oauth/register, public clients, https redirects or localhost), PKCE S256 required,authorization_codeandrefresh_tokengrants. Access tokens last one hour, refresh tokens thirty days; both are bound to the API key and die with it. - Scopes:
mcp:read,mcp:write. Keys with the broaderread/writescopes are accepted too. - A 401 carries
WWW-Authenticate: Bearer … resource_metadata="…", so any MCP client that implements the authorization spec finds the sign-in flow on its own.