iOS affiliate linking app: StoreKit 2 integration guide

import AttribloomKit

// Use your app's opaque account key, never an email address. Create a new facade
// when accounts change; do not copy another account's token into this account.
func makeAttribution(for appAccountID: String) -> Attribloom {
    Attribloom(store: KeychainTokenStore(accountID: appAccountID))
}

// Call from an explicit referral-code or user-initiated paste/link action,
// after the permission checks required by your actual integration.
func acceptReferral(
    attribution: Attribloom,
    signedClickId: String? = nil,
    refCode: String? = nil,
    attributionPermitted: Bool
) async -> BindResult? {
    guard attributionPermitted else { return nil }
    do {
        _ = try await attribution.resolveToken(signedClickId: signedClickId, refCode: refCode)
        return try await attribution.binding() // includes a saved optional offer code
    } catch {
        // Offer a referral retry. Keep purchases and entitlement restoration available.
        return nil
    }
}

import AttribloomKit
import StoreKit

// No attribution network request occurs on the purchase path. Pass the facade
// for the current app account. Denied/withdrawn permission means no token option.
func purchaseWithAttribution(
    product: Product,
    attribution: Attribloom,
    attributionPermitted: Bool
) async throws -> Product.PurchaseResult {
    let token = attributionPermitted ? (try? await attribution.appAccountToken()) : nil
    let options: Set<Product.PurchaseOption> = token.map { [.attribloom($0)] } ?? []
    // Handle verification, entitlement delivery and transaction.finish() in your
    // existing purchase-result handler, for both attributed and ordinary purchases.
    return try await product.purchase(options: options)
}

import crypto from "node:crypto";

// Forward EVERY App Store Server Notification v2 your server receives to Attribloom,
// off the critical path (a delivery failure must never affect your own unlock logic).
const SURFACE_ID = "<your-surface-id>";          // last path segment of your Forwarding URL
const SECRET     = process.env.ATTRIBLOOM_FORWARDING_SECRET; // same value as Attribloom

async function forwardToAttribloom(signedPayload) {
  const ts   = Math.floor(Date.now() / 1000).toString();    // unix SECONDS, not ms
  const body = JSON.stringify({ signedPayload });            // Apple's JWS, verbatim
  const sig  = "sha256=" + crypto
    .createHmac("sha256", SECRET)
    .update(`${ts}.`)      // timestamp + "."
    .update(body)           // then the exact bytes you POST
    .digest("hex");

  await fetch(`https://api.attribloom.com/v1/app-store/assn/${SURFACE_ID}`, {
    method:  "POST",
    headers: {
      "content-type":   "application/json",
      "x-ea-timestamp": ts,   // unix seconds string
      "x-ea-signature": sig,  // "sha256=" + hex
    },
    body,
  });
}