You already have the pieces
Affiliate attribution on iOS is often sold as a heavy client SDK that inspects receipts and guesses at installs. You do not need that. StoreKit 2 and App Store Server Notifications v2 give you a deterministic path using Apple's own APIs, which means less client code, no receipt-parsing library, and no fingerprinting.
The two moving parts are a UUID you set on the purchase and a signed notification Apple sends your server. Everything else is bookkeeping.
The three steps
First, bind the referral. On first launch your app calls Attribloom, which returns an appAccountToken minted against the referring affiliate. Your app must not generate its own UUID, because a self-invented token attributes to no one. Second, set that token on the StoreKit 2 purchase option. Apple echoes it back, signed, in the transaction. Third, forward each App Store Server Notification v2 to your attribution endpoint, which reads the token, finds the affiliate, and records the conversion at the real transaction value.
- Bind: fetch the Attribloom-issued appAccountToken and persist it.
- Purchase: set the token on the StoreKit 2 purchase, no receipt SDK required.
- Confirm: forward the signed notification server-side for verification and accrual.
Why this beats an SDK and a fingerprint
A third-party receipt SDK adds a dependency to your binary and still cannot see conversions the way Apple's signed notifications can. Device fingerprinting is worse: since iOS 14.5, using it for attribution violates Apple's App Tracking Transparency rules. The Apple-native path is both compliant and deterministic, because it reads the exact token that rode the purchase.
Attribloom implements the server-side hard part: it re-verifies Apple's JWS chain, matches the token to an affiliate, applies commission on a double-entry ledger, and reverses it on refund. Your app's footprint is a bind call and one purchase option.