Affiliate tracking explained: how a link click becomes a commission
Affiliate tracking connects a partner's link click to a paid sale. 6 handoffs, 4 methods and 10 checks show how links and cookies work and where each leaks.
Muzahid Maruf, FounderUpdated
On this page
- 01What an affiliate link means
- 02How affiliate tracking works, from click to commission
- 034 ways to track a referral
- 04Which partner gets the credit
- 05How to use an affiliate link as a partner
- 06Where affiliate tracking breaks
- 0710 checks to run on your own tracking
- 08What TrackRev does for affiliate tracking
Explore with AI
Opens this article inside the chosen assistant with a ready-made prompt.
Affiliate tracking records which partner's link a customer clicked and credits that partner when the customer pays.
The merchant's server logs the click and sets a visitor ID cookie, and a Stripe webhook later matches the payment back to that visitor.
6 handoffs sit between click and commission, and a failure at any one, from an Apple Safari cookie rule to a missing Stripe Checkout field, files the sale under direct.
Key takeaways
- 6 handoffs connect a click to a commission, and a failure at any one files the sale under direct.
- Safari 12.1 capped script-written cookies at 7 days in 2019. Save the visitor ID at signup so no cookie has to survive until the first payment.
- Stripe takes the ID in client_reference_id (200 characters) or metadata (500-character values). Without one of them the webhook has nothing to match.
What an affiliate link means
An affiliate link is an ordinary web address with a partner ID attached, such as ?ref=jane, go.acme.com/jane or the tagged link formats that Amazon Associates' operating agreement requires.
The merchant's system must read the ID, store it and match it to a payment days or weeks later.
The Federal Trade Commission's Endorsement Guides Q&A describes the partner's side: link to a retailer, earn a commission when a reader buys.
How affiliate tracking works, from click to commission
| Step | What happens | What gets recorded |
|---|---|---|
| 1 | A click on go.acme.com/jane reaches a redirect on the merchant's domain | Partner, from the slug |
| 2 | The server logs the click and marks bots so they earn no credit | Partner, timestamp, user agent, referrer, visitor ID |
| 3 | The server answers 302 with a Set-Cookie header, often with Max-Age=31536000 | Visitor ID in a cookie, often in the URL too |
| 4 | Signup saves the ID, and payment creation writes it onto the Stripe Checkout Session | User record; client_reference_id (200 characters) |
| 5 | Stripe sends checkout.session.completed, then invoice.paid per invoice | Charge amount and ID at the webhook endpoint |
| 6 | A matching job finds the click, applies the credit rule and the rate | Ledger row; a refund writes the reversal |
A referral that pays on day 41
Take a partner named Jane on a 30% recurring commission and a $49 monthly plan (illustrative numbers). A visitor clicks her link on a Tuesday, signs up 5 days later and makes the first payment 41 days after the click.
| Day | Event | What the match uses |
|---|---|---|
| 0 | Click on go.acme.com/jane | Click row and visitor ID from the redirect |
| 5 | Signup with a new email | ID copied to the user record beside the email |
| 41 | First payment, $49 | ID on the Checkout Session; the click is 41 days old |
| 71 | Second payment, $49 | Renewal inherits the first payment's credit |
A 30-day cookie window would have closed 11 days before the first payment, and the sale would be filed as direct.
With a 60-day window the first payment earns Jane $14.70 ($49 × 0.30), and a customer who stays 12 months earns her 12 × $14.70 = $176.40. Lose the ID at day 41 and all $176.40 goes with it.
4 ways to track a referral
| Method | Matched on | Typical gap |
|---|---|---|
| Link and cookie | Visitor ID in a cookie | Safari deletes script-written copies after 7 days |
| Coupon code | Personal code on the discount | The customer has to type it, and a shared code credits 0 partners |
| Postback | Click ID from a network | 1 call per sale to the network, plus development work to carry the ID to payment |
| Email match | Email saved at signup | Buyer pays with a different address |
Which partner gets the credit
Say a visitor clicks 3 partners' links (A on day 1, B on day 10, C on day 20) and pays $49 on day 21.
The credit rule decides who earns the 30% commission, and the attribution models comparison has the trade-offs.
| Rule | Who is credited | Commission on $49 at 30% |
|---|---|---|
| Last click | Partner C | $14.70 to C |
| First click | Partner A | $14.70 to A |
| Shared | A, B and C equally | $4.90 each |
How to use an affiliate link as a partner
Use the link exactly as the partner dashboard issues it, since a shortener or an edited ID can drop it, and check in a private window that the landing address still carries the ID.
Audio and print have nothing to click, so ask for a personal coupon code.
Under the Federal Trade Commission's Endorsement Guides the commission should be disclosed close to the recommendation, and "affiliate link" alone may not be understood; see the compliance guide.
Where affiliate tracking breaks
Browser rules are the first place to look. Statcounter's September 2026 data puts Safari at 46.38% of US mobile browser use, 1.06 points behind Chrome's 47.44%.
| Rule | Version and announcement date | Effect on a partner cookie |
|---|---|---|
| Script-cookie cap | Apple Safari 12.1 and iOS 12.2, Feb 21, 2019 (Intelligent Tracking Prevention 2.1) | Cookies created through document.cookie get a 7-day expiry cap |
| Link-decoration cap | iOS 12.3 and macOS 10.14.5, Apr 24, 2019 (ITP 2.2) | 1 day, when a classified tracker sent the visitor and the URL has a query string or fragment |
| Third-party block | Safari 13.1 and iOS 13.4, Mar 24, 2020 | Cookies for cross-site resources are blocked by default |
| Partitioning | Mozilla Firefox 86 (Strict mode), 90 (private windows), 103 (all users) | Cookies are keyed to the top-level site, so a network's cookie does not follow the visitor between merchants |
Sources: WebKit's ITP 2.1, ITP 2.2 and Safari 13.1 posts, and MDN's State Partitioning page.
WebKit's tracking prevention page now words the 7-day rule as deletion after 7 days without user interaction.
A cookie your own server sets in a Set-Cookie header sits outside it, and the click row in your own database is untouched by browser rules. In MDN's Set-Cookie reference Max-Age counts seconds, so the 31536000 below is 365 days.
HTTP/1.1 302 Found
Location: https://acme.com/pricing?_vid=3f6c9a52-81d4-4c0e-9a77-5b2f1de0a4c8
Set-Cookie: vid=3f6c9a52-81d4-4c0e-9a77-5b2f1de0a4c8; Max-Age=31536000; Domain=acme.com; Path=/; Secure; SameSite=LaxCookies that miss the checkout
A cookie set on www.acme.com with no Domain attribute is readable only on that host. Domain=acme.com shares it with app.acme.com, but a Stripe-hosted checkout usually sits on another registrable domain, so the ID must travel in the request.
Stripe offers 3 places to put it.
| Field | Limit | Where it comes back |
|---|---|---|
Checkout Session client_reference_id | 200 characters | checkout.session.completed |
| Metadata on a Stripe object | 50 keys, 40-character keys, 500-character values | Events for that object |
| Payment Link URL parameter | 200 characters of letters, digits, - and _ | The same event |
A Payment Link silently drops an invalid value, so a UUID passes and an ID with a dot or an @ vanishes without an error.
Windows shorter than the sales cycle
TrackRev's program setup proposes 60 days and accepts 1 to 3,650. Choose yours from data: pull the last 100 paying customers, compute the days from first partner click to first payment, and set the window just past the 90th percentile.
If 90 of the 100 paid within 62 days, 75 days covers them with margin, while 365 days starts crediting clicks that played no part in the decision.
Webhooks and renewals
Stripe's webhook documentation sets the rules. invoice.paid fires on every successful invoice, so a handler that listens only for checkout.session.completed pays a partner once and misses each renewal, as the subscription tracking guide explains.
| Rule | Value |
|---|---|
| Live-mode retries | Up to 3 days, with exponential backoff |
| Sandbox retries | 3 over a few hours |
| Manual resend | 15 days from the Stripe Dashboard, 30 days with the Stripe CLI |
| Ordering | Not guaranteed; dedupe on the event ID |
| Response | A 2xx before any slow work |
10 checks to run on your own tracking
| Check | Pass condition | If it fails |
|---|---|---|
| 1. Fresh Safari window, your partner link | A visitor cookie is set; read its expiry in the Storage tab | A script-written cookie falls under the 7-day rule, so set it from the redirect and save the ID at signup |
| 2. Google Chrome with uBlock Origin on | The cookie is still set | A filter list matches your redirect or script host; serve it from your own domain |
| 3. Landing address after the redirect | The ID is still in the URL | A shortener or click wrapper dropped it; use a path slug |
4. curl -I on the link | 1 hop, a 302, before the landing page | Each extra hop is another place to lose the ID |
| 5. Stripe test card 4242 4242 4242 4242 | The Checkout Session shows the ID in client_reference_id or metadata | The field is missing, or a Payment Link dropped an invalid value |
| 6. Event deliveries for that payment | A 200 within seconds | The endpoint is failing; see the retry rules above |
| 7. Phone click, then laptop signup and payment with 1 email | The sale reaches the partner | A cookie belongs to 1 browser, so match on the signup email |
| 8. Refund the test payment | The commission reverses | Refunds are not reaching the ledger |
| 9. Last 30 days of partner-referred charges | Count those carrying a visitor ID | Organic signups carry none, so judge only the referred set |
| 10. Click counts from your 3 biggest partners | Close to your own log | More clicks on their side point upstream, at a blocked script or stripped parameter; equal clicks with missing sales point downstream, at the cookie, the payment field or the webhook |
What TrackRev does for affiliate tracking
Each partner link is a server-side redirect on a TrackRev domain or a custom tracking domain with 1 CNAME record.
It logs the click, flags bots, sets the vid cookie for 365 days and passes the ID to your page as _vid. A pixel on your site tags Stripe Payment Links, Buy Buttons and pricing tables.
At payment it reads the ID from charge metadata, then the Checkout Session, then the customer's email if your site called trk.identify(email).
The pixel's cookie is written by JavaScript, so Safari's 7-day rule applies to it; the click log stays on the server.
One workspace-wide rule sets credit (last click, first click or shared). Each program sets its own cookie window and can hold commission for 0 to 180 days, with 0 the default.
Personal coupon codes credit partners who can't use links, and refunded or disputed charges take their commission back out.
| Plan | Price | Affiliate program | Commission tracked a month |
|---|---|---|---|
| Free | $0 | Locked; link tracking only, with 50 links and 1,000 events a month | None |
| Starter | $39 a month | Unlocked, 1 workspace | Up to $10K |
| Growth | $99 a month | Unlocked, unlimited workspaces | Up to $100K |
| Scale | $199 a month | Unlocked, unlimited workspaces, priority support | Unlimited |
From the pricing page. Annual billing pays for 9 months and gives 12.
Skip TrackRev if an affiliate network's contract makes its pixel the record for disputes. It reads revenue from Stripe, Polar, Lemon Squeezy and Paddle.
The 8-step build is in affiliate tracking without third-party cookies, and the affiliate program page covers links and payouts.
Found this useful? Share it.
Frequently asked questions
- A normal URL plus a partner ID, such as acme.com/pricing?ref=jane. The visitor sees the same page, and only the merchant's click log shows the visit came from Jane.
- No. A $49 plan costs $49 through Jane's link, and her 30% commission of $14.70 comes from the merchant's revenue. Only a coupon changes the price.
- As long as the program sets it, up to the browser's limits. TrackRev's setup form starts at 60 days and accepts up to 3,650, and Safari can delete a script-written copy after 7 days.
- Open 1 test payment in Stripe, look for the visitor ID in client_reference_id or metadata, then check its webhook delivery for a 200.
- For link tracking, no: click capture needs no script. Revenue matching adds 1 pixel tag, and a Checkout Session from your own backend needs 1 line passing client_reference_id.
- In TrackRev a refunded or disputed charge takes its commission back out, and a hold of 0 to 180 days per program keeps new commission pending until your refund window passes.
Written by
Founder, TrackRev.io & Contant.io
Muzahid Maruf is the founder of TrackRev.io and Contant.io. He writes about marketing attribution, link tracking, and revenue analytics for SaaS teams.
Writes about Marketing attribution · Link tracking · Revenue analytics · SaaS growth
Stop guessing where your revenue comes from.
Set up TrackRev in about five minutes. The free plan covers 1,000 events a month, no card needed.
Start free