How affiliate tracking works: cookies, click IDs, and server-side tracking

Affiliate tracking connects a sale to the partner who caused it. The partner shares a unique link, the click is recorded, and when that visitor later buys, the sale is matched back to the click. The partner who owned the link earns the commission.

That sounds simple. The details are where most programs lose sales, and where browser privacy changes have broken older tools.

The four steps

1. Tracked link. Each partner gets a unique link, for example yourbrand.link/sarah. The link records the click, then redirects to your site, app, or store.
2. Click ID. The click gets a unique identifier, stored with the visitor so the visit can be recognised later.
3. Conversion. The visitor signs up or buys, possibly days later.
4. Match and credit. The conversion is matched to the click ID, and the partner is credited with the sale and the commission.

Where the click is remembered

How the click ID is stored decides how reliable tracking is.

Method	How it works	Reliability today
Third-party cookie	Set by the tracking company's domain	Poor. Blocked by Safari, Firefox, and many browsers
First-party cookie	Set on your own domain	Good, but limited in some browsers to shorter lifetimes
URL parameter passed to checkout	Click ID travels with the visitor into checkout	Good, survives cookie restrictions
Discount or referral code	Customer types a partner's code	Good for creators, works with no click at all

The more of these you use together, the fewer sales go unattributed.

Pixels vs server-side conversions

There are two ways to tell the tracking system that a sale happened.

Browser pixel. A snippet on the thank-you page fires when the page loads. It fails when the page is blocked, skipped, or never loads, for example when an ad blocker is running or the customer closes the tab after paying.

Server-side conversion. Your payment system reports the sale directly. A Stripe webhook or a Shopify order webhook fires from the server whether or not the customer's browser cooperates.

Server-side is the modern default. It is also more trustworthy for commission, because the sale comes from the system that actually took the money, not from a page view.

Attribution rules

When more than one partner touched the same customer, a rule decides who gets credit.

• Last click. The most recent partner link clicked wins. The most common rule.
• First click. The first partner to introduce the customer wins.
• Code over click. If the customer typed a partner's code at checkout, that partner wins, because the code is a deliberate choice at the moment of purchase.

Pick one rule and publish it in your partner terms.

The attribution window

The window is how long after a click a sale still counts. Common choices:

• 7 days for impulse purchases and low-priced products
• 30 days as a general default
• 60 to 90 days for considered purchases and B2B software

Too short and partners lose sales they genuinely drove. Too long and you pay for sales they had little to do with.

Refunds and reversals

Good tracking does not stop at the sale. When an order is refunded, the commission on it should be reversed automatically, and commission should wait in a hold period until your refund window has passed. Otherwise you pay commission on revenue you no longer have.

Mobile apps and in-app browsers

Affiliate links shared on social media often open inside Instagram's or TikTok's own browser, which keeps its own separate cookies. App installs add another gap, because the app store sits between the click and the first app open. Tracking that handles device routing and deferred deep linking keeps the partner's credit across that jump. See why in-app browsers break install links.

How Bridgly does it

• Partner links live on your domain and record each click with a click ID.
• Sales come from server-side sources: Stripe and Shopify webhooks, or a sales API call from your checkout.
• Each sale is matched to the click within your cookie window and credited to the partner.
• Commission waits out your hold period and is clawed back automatically on refunds.
• You cannot hand out partner links until a sales source is connected, so every link can actually be credited.

The short version

• A tracked link records the click; a click ID remembers it; the sale is matched back.
• Third-party cookies and browser pixels are unreliable now; use first-party data and server-side conversions.
• Publish one attribution rule and a cookie window that fits your buying cycle.
• Hold commission until refunds clear, and reverse it automatically on refunds.

See partner tracking in Bridgly → · Track affiliate sales in Stripe