How attribution works

Attribution is the process of connecting a sale back to the affiliate who drove it. Attribloom handles this differently for web conversions and iOS App Store purchases.

Web / store attribution

1. A visitor clicks an affiliate's tracking link. Attribloom records the click (affiliate, timestamp, campaign) and immediately redirects the visitor to the destination.

2. The visitor completes a purchase on your site or store.

3. Your server sends a signed postback to Attribloom reporting the sale.

4. Attribloom verifies the postback signature, then matches the sale to the recorded click, using the affiliate code or click ID you include in the postback.

5. Commission is calculated and credited to the affiliate.

The click must be recorded before the sale is reported. If a postback arrives without a matching click, or with an invalid signature, attribution fails and no commission is credited.

iOS App Store attribution

1. At first launch your app fetches an appAccountToken from Attribloom's bind endpoint. Attribloom issues this UUID and ties it to the referring affiliate. Your app does not generate it. The affiliate is identified by a signed click id handed off via the clipboard, a deferred match on the device's IP to a recent click, or a referral code the user enters.

2. Your app sets that appAccountToken on the StoreKit 2 purchase request at the time of purchase.

3. Apple processes the purchase and sends an App Store Server Notification V2 to the merchant's server configured in App Store Connect.

4. The merchant's server relays the unchanged `signedPayload` to Attribloom's Forwarding URL with the forwarding-secret HMAC. Attribloom verifies both that HMAC and Apple's JWS, reads the appAccountToken, identifies the affiliate, and credits commission.

The appAccountToken must be set at purchase time. It cannot be applied after the fact. Attribloom uses StoreKit 2 and App Store Server Notifications V2 for this, not legacy StoreKit receipts or shared-secret verification. Fingerprinting is not used and is banned on iOS since iOS 14.5.

What can cause attribution to fail

• Web: the postback signature is wrong, or no matching click was recorded.
• iOS: the appAccountToken was not set on the purchase, or the bundle ID in App Store Connect does not match the one registered in Attribloom.
• In both cases: the environment must match (Sandbox purchases only attribute in Sandbox; Production purchases only attribute in Production).