There Is No “API Key” Button, Because the Key Sits Inside the Create-a-Feed Download URL
You run an automation script for Awin product feeds.
The script asks for the product feed API key.
Fine. You open Awin, go to Toolbox, then Create-a-Feed.
And there is no obvious API key.
No giant “API Key” button. No friendly “Credentials” box. No “Secret” field waving at you.
Instead you get product counts, categories, advertisers, brands, and a thing called “Feed List Download.”
At this point, the natural response is: how was anyone supposed to know this?
It gets better. Your setup guide says, “copy the value immediately after /apikey/ in the download URL.”
Except the URL currently shown in the interface does not contain /apikey/.
Now the internal incident meeting begins:
“Wrong page?” “Missing permission?” “Different API?” “What is this giant URL?” “Why is Node.js also printing a warning?” “Did everything break at once?”
The short answer: no.
Awin’s product-feed data key is separate from the normal Partner API token. Awin’s own documentation says the data-feed key can be obtained from a Create-a-Feed download. In one current UI pattern observed in October 2026, that key appears as an unlabeled path segment inside the Feed List Download URL.
A treasure hunt, but for credentials.
0. The 30-second version
Six things matter.
- Awin has a normal Partner API credential and a separate data feed API key.
- They are not interchangeable.
- Awin’s official docs say the data-feed key comes from a standard feed download generated through Create-a-Feed.
- The official example uses an /apikey/KEY style URL.
- In the UI pattern observed here in October 2026, Feed List Download used a different URL shape, with the key embedded after the publisher ID.
- Node.js DEP0190 is a separate warning, not proof that your Awin key failed.
So the key is not necessarily missing.
It may simply be unlabeled.
1. What actually happened
The automation script first reported which secrets were already registered, without printing their values.
The regular Awin API token was present.
Then it requested the product-feed key.
Its instruction was based on a legitimate older or alternate URL pattern:
“Toolbox → Create-a-Feed → look at the download URL → copy the text after /apikey/.”
Awin’s Product Feed List Download documentation, updated on August 31, 2026, still shows an /apikey/KEY example and states that the download API key can be obtained from a standard feed download generated by Create-a-Feed.
It also explicitly notes that this key is different from the key used for the Partner API.
So the conceptual instruction was correct.
The practical UI was the trap.
2. The guide says “after /apikey/,” but /apikey/ is not there
The live interface displayed a Feed List Download URL.
After removing all private and credential values, the observed structure looked like this:
https://ui.awin.com/productdata-darwin-download/publisher///1/feedList
Notice anything?
There is no /apikey/.
Guide: “Look immediately after /apikey/.”
Reality: “That employee is not scheduled today.”
That mismatch is enough to make a perfectly competent user assume they are on the wrong page.
In this observed URL, the structure was:
publisher/ → publisher ID → data-feed API key → 1/feedList
This should be treated as an observed October 2026 UI pattern, not as a promise that Awin will preserve that exact path forever.
3. The real confusion: there are two API credentials
This is the part that makes the whole thing feel broken.
Partner API credential
Used for Awin’s general Partner API authentication.
Product feed data key
Used to access product-feed downloads and feed-list resources.
Awin’s official documentation explicitly distinguishes the feed key from the Partner API key.
So if you are thinking:
“I already configured the Awin API token. Why is it asking me for another key?”
That is a reasonable question.
The answer is simply that Awin uses separate credentials for these workflows.
Naming them more differently would have saved several human life-years.
4. What to inspect in the current interface
For the UI pattern observed in October 2026:
- Sign in to Awin.
- Open Toolbox → Create-a-Feed.
- Find Feed List Download.
- Confirm the link is genuinely on an Awin domain.
- Do not paste the full URL into public chats, tickets, articles, Issues, or logs.
- If the URL has the same observed structure, the path segment immediately after publisher// is the data-feed key.
- Paste only the needed secret into the masked script prompt.
- If the prompt displays nothing while typing, that can be intentional secret-input behavior.
The most important item is number five.
A long URL can still contain a credential.
A secret does not stop being a secret because it is hiding between slashes.
5. And what was Node.js DEP0190 doing there?
While all of this is happening, the terminal may print something like:
DEP0190: Passing args to a child process with shell option true...
Excellent timing.
It naturally looks related to the key you just entered.
But Node.js documents DEP0190 as a deprecation warning about using execFile or spawn with an argument array and shell:true. The concern is argument escaping and possible shell injection.
In other words:
it is not an Awin authentication error.
It is still worth fixing separately in the script. If shell:true is unnecessary, remove it. If user-controlled values reach shell arguments, review that path carefully.
But it is not evidence that the product-feed key is wrong.
6. Fix the instructions, not the human
The durable lesson is not “users should inspect URLs more carefully.”
That is a weak system.
A better setup helper should not depend on one literal marker such as /apikey/.
It should:
- recognize the documented /apikey/ pattern;
- also recognize the currently observed productdata-darwin-download/publisher///... pattern;
- never echo the recovered key;
- never log the full credential-bearing URL;
- fail closed when the URL shape is unknown;
- explain up front that the product-feed key differs from the Partner API token.
That one sentence would eliminate a surprising amount of confusion.
7. Conclusion: impossible at first glance, obvious after you know the trick
This was confusing for structural reasons:
- two different Awin credentials;
- no obvious dedicated “product feed API key” field;
- documentation examples that may not match the current UI URL shape;
- a secret hidden inside a long URL;
- an unrelated Node.js warning appearing at exactly the wrong moment.
So yes: how were you supposed to know?
Once you know the model, though, the next attempt is fast:
Product-feed key ≠ Partner API token. Go to Create-a-Feed, inspect the download URL, and do not hard-code one historical URL shape into your brain or your script.
And please do not publish the real URL after finally finding it.
That is the final boss.
Sources
- [1] Awin Help — Product Feed List Download, 2026-08-31: https://help.awin.com/developers/docs/product-feed-list-download
- [2] Awin Help — Downloading feeds using Create-a-Feed, 2026-08-31: https://help.awin.com/developers/docs/downloading-feeds-using-create-a-feed
- [3] Awin Help — Product Feed Publisher Guide Overview: https://help.awin.com/developers/docs/product-feed-publisher-guide-intro
- [4] Node.js documentation — DEP0190: https://nodejs.org/download/release/latest-jod/docs/api/deprecations.html
References (4)
- Awin Help — Product Feed List Download, 2026-08-31 help.awin.com
- Awin Help — Downloading feeds using Create-a-Feed, 2026-08-31 help.awin.com
- Awin Help — Product Feed Publisher Guide Overview help.awin.com
- Node.js documentation — DEP0190 nodejs.org
