What Is an Affiliate Link and How Do Affiliate Links Work?

Every affiliate program on the internet rests on one small object: a URL with an extra parameter on the end. I build affiliate tracking infrastructure for a living, and I still find the humble affiliate link quietly impressive: it’s a plain hyperlink that can move money weeks after somebody clicks it. So what is an affiliate link, exactly, and what happens between the click and the commission?

That gap is where all the interesting engineering lives. In this guide I’ll dissect a real link, follow a click through the whole pipeline, and show you why links break more often than most people realize. Whether you’re an affiliate wondering why some commissions never show up, or a founder about to launch a program, the mechanics are identical, and very learnable.

TL;DR: An affiliate link is a normal URL with an identifying parameter attached, such as yourapp.com/?via=maria, that tells a merchant’s tracking system which partner sent each visitor. When someone clicks it, a script records the click and stores the affiliate’s ID in a first-party cookie, typically for 30 to 90 days. If the visitor buys within that window, the stored ID gets matched to the order, usually via checkout metadata and a billing webhook, and the affiliate earns a commission.

What is an affiliate link?

An affiliate link is a standard URL with a tracking parameter appended that uniquely identifies the affiliate who shared it, so the merchant can credit that affiliate when the visitor buys. The page it opens is the same page everyone else sees; the only difference is the little tag riding along in the address.

What are affiliate links made of? Take one apart and there are exactly three pieces:

https://yourapp.com/pricing?via=maria
\__________________________/\__/\____/
        base URL           param  ID

• The base URL (yourapp.com/pricing): the destination page. Nothing special about it.
• The parameter name (via): a convention that tells the tracking script “the next bit identifies an affiliate.”
• The affiliate identifier (maria): a unique slug assigned to one specific partner.

And that’s the entire object. No hidden payload, no software installed on your device. The intelligence lives on the merchant’s site, in what happens after the click.

What the ?via=, ?ref=, and ?fpr= parameters actually are

Each of these is just a different platform’s convention for the same thing: the query parameter that carries the affiliate’s unique slug. There’s no technical difference, only branding:

• yourapp.com/?via=maria (the convention Rewardful popularized)
• yourapp.com/?ref=maria (a generic convention many programs use)
• yourapp.com/?fpr=maria (FirstPromoter’s convention)
• amazon.com/dp/B0EXAMPLE?tag=maria-20 (Amazon’s Associates tag)

Some programs skip the query string and give each affiliate a path, like yourapp.com/maria; it’s the same move, getting a unique identifier into the request.

One lookalike worth separating out: UTM parameters (utm_source, utm_medium, and friends) feed analytics tools, not affiliate attribution. They can ride on the same URL as the affiliate parameter, but only the affiliate parameter pays anyone.

How do affiliate links work? A click’s journey step by step

Affiliate links work by recording the click, remembering the visitor, and matching any later purchase back to the affiliate’s identifier. Here’s the full journey of one click:

1. The click. A reader clicks yourapp.com/?via=maria in a blog post or YouTube description.
2. The page loads with the parameter. The browser requests the page; via=maria arrives with it.
3. The click gets recorded. A tracking script (or a redirect server) sees the parameter and logs a click server-side: affiliate ID, a freshly generated click ID, timestamp, and landing URL.
4. The browser gets a first-party cookie. The script stores the affiliate ID and click ID so the referral survives beyond this one page view.
5. The visitor leaves and comes back. Days or weeks pass. As long as the return happens inside the attribution window, the stored referral is still valid.
6. Checkout carries the identifier. The stored click ID is read and stamped into the order, for example into a Stripe checkout session’s metadata.
7. A billing event confirms the sale. When payment succeeds, a webhook fires from the billing system to the tracking platform, which looks up the click ID, finds Maria, and credits her commission.

Steps 1 through 4 happen in milliseconds. Steps 5 through 7 can span two months. The whole design problem of affiliate tracking is bridging that gap reliably, and that’s the part I never get tired of.

How the click gets recorded

There are two common architectures, and knowing which one a program uses tells you a lot about where its attribution will hold up and where it’ll leak.

Script-based first-party tracking is what most modern SaaS programs use: a JavaScript snippet on the merchant’s own site reads the parameter and calls the tracking API to register the click. The visitor lands directly on the real page.

Redirect-based tracking routes the click through a tracking domain first: the link points at something like track.example.com/abc123, which logs the click and 302-redirects the visitor onward. Affiliate networks favor this design for a sensible reason; it logs the click even if the destination has no script, at the cost of an extra hop and a tracking domain that ad blockers learn to recognize.

Either way, a serious system records the click server-side, not just in the browser. That record (affiliate ID, click ID, timestamp, landing URL) is the durable copy a sale can be matched against later, even after everything in the browser has been wiped.

First-party cookies plus localStorage mirroring

A first-party cookie is a cookie set under the domain the visitor is actually on. Browsers treat those far more gently than third-party cookies, which Safari and Firefox already block by default. The tracking script writes the affiliate ID and click ID into one, with an expiry matching the program’s attribution window.

Careful trackers write the same identifier to localStorage as well, a separate browser storage area, and check both on every visit. If the cookie disappears but localStorage survives, the referral is restored, and vice versa. I love this bit of redundancy: two imperfect storage mechanisms overlapping cover more visitors than either alone.

How do affiliate links track customer purchases?

Affiliate links track purchases by matching an identifier stored at click time to the order at payment time. At checkout, the tracking script reads the stored click ID and attaches it to the transaction; on Stripe that usually means writing it into the checkout session or subscription metadata.

Then payment succeeds, and the second half kicks in: the billing system fires a webhook (a machine-to-machine notification) to the tracking platform, which finds the click ID in the metadata, looks up which affiliate owns it, and records a conversion with the real amount paid.

Two details separate good implementations from fragile ones:

• The confirmation comes from billing, not from a thank-you page. A pixel on a confirmation page only proves a browser loaded a page. A webhook proves money moved, fires on renewals, and fires again on refunds so commissions can be reversed. For what happens after that, see how affiliates get paid.
• Server-side postbacks cover checkouts with no JavaScript at all. If a sale closes over the phone or inside a native app, the merchant’s server reports the conversion directly to the tracking API (an S2S, or server-to-server, call) with the click ID it captured earlier.

How long do affiliate cookies last? Cookie duration and attribution windows

Most affiliate cookies last 30 to 90 days, with 60 days a common default in SaaS and ecommerce programs. The window is a program policy, not a law of nature: the merchant decides how long after a click a purchase still counts.

I’ve noticed plenty of guides claim that affiliate cookies typically expire within 24 hours or even 30 minutes. That conflates one famous outlier, Amazon, with the industry norm. Real programs publish their windows:

Longer windows favor affiliates who create research-heavy content, since considered purchases take time; shorter windows favor the merchant’s margin, and both are rational plays. If you’re an affiliate, read the window before joining a program, because a 24-hour window and a 180-day window are wildly different businesses.

First-touch vs last-touch: who gets the commission when two affiliates refer the same buyer

Last-touch attribution credits the most recent affiliate whose link the buyer clicked; first-touch credits the earliest one inside the window. Suppose a buyer clicks Maria’s YouTube review in week 1 and Dev’s comparison post in week 3, then buys in week 4. Under last-touch, Dev earns the commission; under first-touch, Maria does.

Last-touch is the industry default, for a defensible reason: the most recent recommendation is usually the one that closed the sale. First-touch makes sense when a program wants to reward discovery, crediting the partners who introduce the product to people who’ve never heard of it.

The part that trips people up: this is a program setting, not a property of the link. The rule lives in the tracking platform’s logic for overwriting (or refusing to overwrite) the stored referral when a second affiliate’s parameter shows up.

Why affiliate links break (the part nobody explains)

A meaningful share of genuinely referred sales never gets attributed, and it isn’t fraud or laziness; it’s browsers and blockers doing their jobs, and doing them well. Understanding the three failure modes below is what separates affiliates who can diagnose a quiet month from affiliates who just shrug at it, and you’re about to be in the first group.

Ad blockers and tracking-script blocking

Per GWI data reported by Backlinko, 29.5% of internet users worldwide use ad blockers, roughly 1.77 billion people as of Q2 2025. And blockers don’t stop at banner ads: community-maintained filter lists such as EasyPrivacy enumerate the domains of known tracking vendors, and any script loading from a listed domain silently fails. The visitor still clicks and still buys; the click is simply never recorded.

The defense is simple once you see it: serve the tracking script from the merchant’s own domain instead of the vendor’s. Filter lists match domains, and a first-party script on yourapp.com looks like the site talking to itself.

Safari ITP: the 7-day cookie cap

Safari’s Intelligent Tracking Prevention is the single biggest silent killer of affiliate attribution. Since ITP 2.1, WebKit states that “all persistent client-side cookies… are capped to a seven day expiry”; that covers any cookie set via JavaScript’s document.cookie, which is how most tracking scripts write theirs. Your program’s 60-day window quietly becomes a 7-day window for Safari users.

It gets tighter. Since ITP 2.2, when a visitor arrives from a domain Safari has classified as a tracker via a “decorated” link carrying identifiers, script-set cookies are capped at 24 hours. And localStorage is no safe haven: for visits arriving the same way, ITP 2.3 deletes non-cookie script-writable storage, localStorage included, after 7 days of Safari use without the user interacting with the site.

Now put a price on that, because the numbers make it real. Maria promotes a $40/mo product at a 25% recurring commission and refers a reader who clicks on their iPhone, thinks it over, and subscribes 12 days later. In Chrome with a 60-day window, that’s Maria’s conversion: $10/mo, $120 over a year of retention. In Safari with a JavaScript-set cookie, the referral evaporated on day 7 and the same sale converts as organic.

Maria earns $0 and never learns why. Multiply by Safari’s share of your traffic and the leak isn’t a rounding error.

Happily, the fixes are architectural, which means they’re buildable: cookies set by the server in an HTTP response, tracking served from the merchant’s own domain, and the server-side click record as the durable source of truth. One thing I’d flag on that first fix: server-set cookies escape the 7-day cap only when the response comes from infrastructure the merchant genuinely controls; newer Safari releases cap HTTP cookies from CNAME-cloaked third-party subdomains at 7 days too, so a custom domain pointed at a vendor isn’t a full escape hatch on its own.

Cross-device journeys and stripped parameters

Cookies live in one browser on one device. The listener who hears a podcast ad, taps the link on their phone, then subscribes from a work laptop is invisible to every cookie-based method ever built; there’s nothing on the laptop to read. No vendor has honestly solved this with cookies, whatever a sales page implies. But that dead end also opens the door to the neatest workaround in this guide: coupon codes, which get their own section below.

Parameters also get mangled in transit: some email security scanners rewrite URLs, some chat apps and in-app browsers strip query strings, and plenty of humans copy a link and lop off everything after the ? because it looks tidy. The visitor arrives; via=maria doesn’t.

Any program whose only attribution method is a JavaScript-set cookie is undercounting, period. Treat the click as a hint and the billing event as the verdict, and give the sales that never involve a click a path of their own.

Link cloaking and custom tracking domains

Link cloaking means wrapping an affiliate link in a short, clean URL on the affiliate’s own site, like yoursite.com/go/product, which redirects to the real destination with the parameter attached. The short URL looks better in a newsletter, it’s easier to update if the merchant changes programs, and it lets the affiliate count outbound clicks themselves.

A custom tracking domain is the merchant-side cousin: instead of loading the tracking script and API from the vendor’s domain, the merchant serves them from a subdomain they control, like go.yourbrand.com. To an ad blocker’s filter list, requests to the brand’s own subdomain are unremarkable, so the script survives where a third-party domain would be blocked. Good tracking software makes this a 5-minute job: the vendor hands you a DNS record (usually a CNAME) that points your chosen subdomain at their servers, and from then on the tracking is first-party in the browser’s eyes. One DNS record and it’s done! Cloaking is cosmetic; the custom domain is structural.

Cloaking doesn’t exempt anyone from disclosure, though. The FTC’s guidance is that an endorsement must make the “material connection” with the brand obvious, including financial relationships, and a prettier URL doesn’t change the relationship.

Running a program yourself? Everything in this section is fixable at the platform level, and it’s precisely the wedge we built Rekomi around: tracking served first-party from your own domain, with every sale confirmed against billing events, so a blocked script or an expired cookie doesn’t quietly cost your affiliates their commissions. A 14-day trial is enough time to watch your first tracked sale come through.

Coupon codes: the affiliate link with no link

A coupon code is attribution with no click at all: the merchant assigns each affiliate a personal code, say MARIA20, and any order redeeming it is credited to Maria regardless of how the buyer reached the site. No parameter, no cookie, nothing for a blocker to block.

That makes codes the workhorse for every channel where clicking is awkward: podcasts, YouTube on a TV, TikTok, Instagram stories, conference talks. It’s also the cleanest solution to the cross-device problem, because the code travels in the buyer’s head instead of in a browser, which I find genuinely delightful.

Codes pair with links rather than replacing them: MARIA20 maps to Maria in the tracking platform, and when the billing system reports an order carrying that code, the conversion is attributed exactly as if her link had been clicked. A well-run program hands every affiliate both, and lets whichever one survives the buyer’s journey do the attributing.

Do affiliate links hurt SEO?

No. Affiliate links don’t hurt a site’s SEO when they’re marked correctly. Google’s guidance is explicit: mark links that are advertisements or paid placements with the sponsored value, per its documentation on qualifying outbound links. The same page notes nofollow remains an acceptable way to flag them, though sponsored is preferred. What can hurt is publishing pages of thin content that exist only to hold affiliate links; the penalty there is for the thinness, not the links.

Also, there’s a legal layer alongside the technical one. In the US, the FTC requires endorsements to disclose any material connection to the brand, placed where readers will actually see it. So the well-dressed affiliate link wears two tags: rel="sponsored" for the crawlers and a plain-language disclosure for the humans.

How to create and track affiliate links for your own program

If you run the product, you don’t build any of this by hand; affiliate link tracking software generates it. When an affiliate joins your program, the platform assigns their slug, mints their link, handles the cookies and click records, matches conversions through your billing system, and shows both sides a dashboard.

What you actually decide is policy: the commission, the attribution window, first-touch or last-touch, and which fallbacks you offer; the only other call is which affiliate platform to run it on. Given everything above, my checklist for the tracking layer is short:

• First-party tracking served from a custom domain
• Conversions confirmed by server-side billing events, not a pixel
• Coupon codes for the no-click channels
• Commissions that follow the money through renewals and refunds

That checklist is, not coincidentally, how we built Rekomi’s affiliate link tracking.

The links are the easy part; the program around them takes more thought, and it’s a fun build. If you’re starting from zero, the step-by-step is in my guide to how to start a SaaS affiliate program.

Frequently asked questions

How do Amazon affiliate links work?

Amazon Associates links carry a ?tag= parameter with the affiliate’s tracking ID. Per Amazon’s help pages, the visitor must add a qualifying item to their cart within 24 hours of arriving through the link; items added in that window still earn if the order completes before the cart expires, usually 90 days. It’s the shortest major attribution window in the industry, offset by Amazon’s conversion rates.

How do I create an affiliate link?

Join the program; the platform mints the link for you. Once you’re approved, your affiliate dashboard shows a unique URL with your slug already attached, ready to copy. Most platforms also let you deep-link to any page on the merchant’s site by keeping the parameter, for example yourapp.com/pricing?via=you. Amazon affiliates generate theirs directly on product pages with the SiteStripe toolbar.

How do you use affiliate links?

Place them where the recommendation actually happens: product reviews, tutorials, comparison posts, YouTube descriptions, newsletters. Mark each one with rel="sponsored" and put a plain-language disclosure where readers will see it, per the FTC guidance above. For channels where nobody clicks, like podcasts and conference talks, lead with your coupon code instead and let it do the attributing.

What is the difference between an affiliate link and a referral link?

Mechanically they’re the same object: a URL with an identifying parameter. The difference is who holds it and what they earn. Affiliate links go to external partners paid cash commissions; referral links go to existing customers rewarded with credits or discounts for inviting friends. I break down the two models in affiliate marketing vs referral marketing.

Are affiliate links safe to click?

Definitely. An affiliate link opens the same page as the plain URL and the price you pay is the same; the parameter only tells the merchant who referred you, and the commission comes out of the merchant’s margin.

Can affiliates see who bought through their link?

Generally no. Affiliate dashboards show aggregate clicks, conversions, and commission amounts, sometimes with an anonymized transaction list. Buyer names and emails stay with the merchant, both for privacy reasons and because affiliates don’t need them to get paid.

How do I know if a link is an affiliate link?

Look at the URL. A query parameter like ?via=, ?ref=, ?fpr=, ?aff=, or Amazon’s ?tag= is the giveaway; on a cloaked link like site.com/go/product, click it and check the address bar you land on, since the redirect usually appends the parameter in plain sight. Publishers following FTC rules will also tell you outright in a disclosure near the link.

How do I track affiliate link performance?

Start with the numbers every dashboard gives you: clicks, conversions, conversion rate, and earnings, per link and per placement. The most useful derived metric is EPC, earnings per click, because it makes wildly different placements comparable; I wrote a full explainer on what EPC means in affiliate marketing.

See it for yourself

Go dissect a live one; it takes 10 minutes and makes everything here concrete. Find an affiliate link in any YouTube description, open your browser’s developer tools (Application tab, then Cookies), and click the link. Watch the parameter arrive in the URL, then find the freshly written cookie and read its expiry date. That’s the whole machine, sitting right there in your browser! You now know that program’s attribution window and parameter convention, which is more than most affiliates ever learn about the links they share.

And if you’re on the merchant side and ready to hand out links of your own, that’s the product we build: Rekomi handles the links, the cookies, and the payouts. Start a 14-day free trial and watch your first tracked click come through.