---
title: "Count one landing on a referral link. Unauthenticated, 204 (spec 1.1)."
method: POST
path: "/api/v1/affiliate/clicks"
tags: ["Affiliate"]
---

# Count one landing on a referral link. Unauthenticated, 204 (spec 1.1).

`POST /api/v1/affiliate/clicks`

## Request

- Base URL: `https://api.avatarfactory.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.avatarfactory.io/api/v1/affiliate/clicks`
- Auth: one of:
  - API key in cookie `session`
  - HTTP bearer

<br/>The marketing site fires this once per page load that carries a valid<br/>`?ref=`, with `keepalive: true` and nobody reading the response, so the<br/>route answers 204 to everything it is handed: an unknown code, a code<br/>whose affiliate is still pending, a body that is not JSON, a visitor who<br/>already counted today. Every one of those is the same silence, because an<br/>endpoint that answered them differently would be a free oracle for<br/>"which referral codes exist" to anyone with a script.<br/><br/>The body is parsed here instead of being declared as a `body:` parameter:<br/>the framework answers an unparseable body with its own 422, and this<br/>route promises 204. `ClickBeaconRequest` still owns the shape.<br/><br/>The ONE refusal a caller can see is 429. A rate limit has to be visible<br/>or a client cannot back off, and the limit is per ip, so saying it out<br/>loud reveals nothing about any affiliate. The limiter fails open: an<br/>unreachable Redis lets the click through rather than blocking the site.<br/><br/>The identity of the caller is `request.remote_addr` and nothing a client<br/>can write. See `clicks.client_ip`: with `X-Forwarded-For` read directly,<br/>anyone could mint a fresh visitor per request and both the dedup and the<br/>rate limit would be decoration.

## Response `204`

No Content

## Other responses

- `422`: Unprocessable Entity
- `429`: Too Many Requests

---

[API](https://skmtc.dev/avatarfactory/apis/avatarfactory-api.md) · [All operations](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/llms.txt) · [OpenAPI document](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/revisions/66fc7aa3f296?raw)