Affiliate tracking that ad blockers can't break: server-side attribution for Stripe SaaS

A typical affiliate setup is a script that reads ?via=jane from the URL, drops a cookie, and hopes the cookie is still there when the visitor pays. Ad blockers, strict browser privacy settings, a switch from phone to laptop, or a checkout on another domain each break that chain, and the affiliate never sees the sale. Affiliates notice the gap and stop promoting.

The fix is to stop relying on the browser for the part that matters.

Split the job in two

1. The browser records the click. Kickrail's script stores a click id (kr_ref) in a first-party cookie and local storage, on the widest domain your browser allows, so www. and app. share it. That part is cheap and works for most visitors.
2. Your server records the signup. Right after you create a user, one call ties that user to the affiliate. From then on, the browser doesn't matter: every Stripe payment from that user is matched from your webhooks.

The call

app.post("/signup", async (req, res) => {
  const user = await createUser(req.body);
  // Report it. Don't let a Kickrail hiccup break signup.
  fetch("https://kickrail.com/api/v1/referrals", {
    method: "POST",
    headers: {
      Authorization: "Bearer " + process.env.KICKRAIL_SECRET_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      referral: req.cookies.kr_ref ?? req.body.kickrail_referral,
      email: user.email,
      user_id: user.id,
      ip: req.ip, // for self-referral checks
    }),
  }).catch((err) => console.warn("kickrail", err));
  res.redirect("/welcome");
});

You can send every signup. If nothing points at an approved affiliate, the answer is {"referred": false} and nothing is stored. The call is safe to repeat, and it works on every Kickrail plan, including Free.

When there's no cookie at all

• A code typed at signup. Pass it as code, for example JANE20, and the affiliate is credited without any click.
• A code typed at Stripe Checkout. If the campaign has a Stripe coupon, each affiliate code is a real Stripe promotion code, and the redemption alone credits the affiliate. See how affiliate codes work with Stripe promotion codes.
• Only the token survived. Pass via with the affiliate's token.

Then you never report payments

Kickrail reads your Stripe events. Each paid invoice is matched to the referral by Stripe customer, or by email if the customer didn't exist yet at signup, and the commission is created. Refunds and disputes reverse it. Once a referral has a Stripe customer, Kickrail also writes the referrer onto the customer's metadata, so you can see "referred by jane" in the Stripe dashboard.

Guarding against self-referrals

The ip you send is stored only as a hash and compared with the IPs the affiliate signs in from. Matching emails and company domains are checked too. A match doesn't block the signup; it holds the commissions for your review.

The full reference is in reporting signups from your server.