track.js

track.js is Affilyflow's tracking script for webshops and websites. It stores the click when a customer lands from an affiliate link and reports the sale when the customer reaches the receipt.

Add the script

Add the line to <head> on every page – including the receipt page.

<script src="https://app.affilyflow.com/t/DIN_BUTIK.js" async></script>

/t/DIN_BUTIK.js is the store's own script: the same track.js, with the store's settings from Setup (Google Analytics, VAT, shipping, consent) added by our server. Change a setting in Setup and it applies on your site within minutes – the line never changes. The older line still works, with the settings as attributes:

<script src="https://app.affilyflow.com/track.js" data-store="DIN_BUTIK" async></script>

DIN_BUTIK is your store ID. The exact line with your ID is under Setup in the store dashboard – copy it from there.

Use async: the script must never hold the page back. The exception is the no-code lead trigger (data-lead-url), where the line must be without async – see Leads without code.

https://app.affilyflow.com/s.js is the same file as track.js under a neutral name. Both addresses work, now and in the future. See Neutral addresses and your own proxy.

Attributes

What the script stores

When a customer lands with ?afid= in the URL, the script stores the click ID both as a cookie and in localStorage, so it survives either one being cleared. If the site cleans the URL before the script runs (e.g. a router with "clean URLs"), afid is also read from the URL the page was requested with – the browser's navigation entry. A redirect without the parameter never yields a false value.

The script also reads the af_srv cookie but never sets it. It is only set by the store's own server (see Tracking from your server) and means the server set the click cookie. With af_srv=1 the script never rewrites af_click or af_t – Safari would shorten a cookie written by JavaScript to about 7 days, even if the server set it first. localStorage is still written as a backup.

• Lifetime: at most 90 days from the click. The cookie's max-age is always what is left of the 90 days.
• Return visits never extend the window. On every visit the cookie and localStorage are written again with the remaining time, so a deleted cookie is restored from localStorage – but the timestamp is always the click's.
• localStorage stores the value as { v, t } – the value and the time of the click. A value older than 90 days is deleted when read.
• The cookie is set with path=/ and SameSite=Lax, and with Secure on https.
• Domain: the cookie is set on the broadest domain the browser allows (shop.com rather than www.shop.com), so the click follows the customer to a receipt on another subdomain. The script finds it with a short-lived test cookie (_af_d) that is deleted immediately. On an IP address or localhost the exact host is used.
• Memory: the click ID from the URL is also kept in the page's memory, so a sale on the same page works even when storage is blocked (e.g. a private window).
• af_t lets the store's server renew the cookie on a return visit without extending it beyond 90 days from the click.

Only Affilyflow click IDs

Only an afid that looks like ours (c_ followed by 4–64 characters: letters, digits, _ and -) is stored. If the store also uses another network with a parameter called afid, the foreign value can never overwrite an Affilyflow click.

Coverage

When a customer lands with a click ID, the script reports it to Affilyflow – and again when the click is stored in the browser, and if the customer actively declines marketing. The report only contains the click ID, the store ID and the consent state – nothing about the visitor. The landing report itself stores nothing in the browser, so it is also sent while the script waits for consent.

This is what Tracking coverage under Setup in the store dashboard is built on: how many clicks from affiliates reached a page with the script, were stored and became a sale. See Testing and troubleshooting.

affilyflow.conversion()

Report a sale from JavaScript. The call only works once track.js is loaded on the page.

affilyflow.conversion({ order: '1008', total: 499, currency: 'DKK' });

How the call behaves:

• Without an affiliate click in the browser nothing is sent – and no error is logged. A normal purchase without an affiliate is not an error. The exception is a personal discount code.
• The sale is sent with navigator.sendBeacon, so it arrives even if the page navigates away right after. Without sendBeacon an invisible image request is used.
• With data-consent="required" the call waits until consent is settled and is sent only then.
• For a lead program: affilyflow.conversion({ order: 'lead_' + Date.now() }) – no amount.

Personal discount codes

With coupon, a sale can be attributed to a personal discount code the store has given an affiliate:

affilyflow.conversion({ order: '1008', total: 499, currency: 'DKK', coupon: 'ANNA10' });

• With a click the sale is sent as always, with the code included. A valid click always wins over the code. If the click has expired or is unknown, a personal code can still attribute the sale.
• Without a click the script fetches a list of one-way fingerprints (SHA-256) of the store's personal codes and compares. Only if a code is on the list, and there is an order number, is the sale sent – with the codes that matched. A general code or no code sends nothing.
• The code needs no storage in the browser. With data-consent="required" a sale with a code waits at most 3 seconds for consent; without consent the code can still attribute the sale.

Codes are compared without spaces and in upper case. A general code for all affiliates earns no commission on its own – only the link does. The sale line has the same option with data-affilyflow-coupon, and with data-sale="ga4" the coupon of the Google Analytics purchase is read.

<script>
  (function () {
    var tries = 0;
    (function send() {
      if (!window.affilyflow) { if (tries++ < 50) setTimeout(send, 200); return; }
      affilyflow.conversion({ order: '1008', total: 499, currency: 'DKK' });
    })();
  })();
</script>

Amounts as text

A number is used as is. Text that is a valid machine number is also used as is. Other text is cleaned: everything except digits, dot, comma and minus is removed, and the last separator is the decimal mark. If there is only one separator with exactly three digits after it, it is a thousands separator.

Rejected placeholders

If the template's placeholder is still in order, the sale is sent without an order number – a placeholder must never take up an order number, or every later sale would be rejected as a duplicate. These values count as placeholders (case-insensitive):

• DIN_ORDRE_ID, DIT_ORDRE_ID, ORDRE_ID, ORDER_ID, YOUR_ORDER_ID, ORDERID
• XX, XXX etc. (two or more X)
• Anything in {{ … }}, [ … ], < … > or % … % – a template variable that wasn't filled in

The server applies the same rule.

Duplicate guard in the browser

The server never counts the same order number twice in the same program. The browser also remembers what it has sent, so a reloaded receipt doesn't send again:

• With an order number: kept in localStorage (af_sent) for 30 days.
• Without an order number: kept in sessionStorage (af_sent_s) as page and amount – the same receipt with the same amount is sent once per tab.

affilyflow.consent()

The store's own consent solution can control the script directly. Only relevant with data-consent="required".

affilyflow.consent(true);  // store the click from the URL and send waiting sales
affilyflow.consent(false); // delete af_click, af_store, af_aff, af_t, af_srv and af_sent

If the visitor says yes again on the same page, the click from the URL is stored again.

Consent

With data-consent="required" the script stores nothing in the browser – no cookie, no localStorage or sessionStorage, no test cookie – until marketing consent is given. Until then the click only lives in the page's memory and is not used. Without the attribute the script behaves as before.

<script src="https://app.affilyflow.com/track.js" data-store="DIN_BUTIK" data-consent="required" async></script>

The script reads consent itself from:

• A yes works whether the banner answers before or after the script. Cookie Information's, Cookiebot's and Shoporama's events and Consent Mode updates in dataLayer are listened to throughout. DanDomain's and Smartweb's banners reload the page after the choice, so the answer is ready on load. window.affilyflowConsent is checked on load and for the first 10 seconds, and TCF is used when its API is present within those 10 seconds.
• A no only deletes on an active action (Cookie Information's and Cookiebot's events, TCF's useractioncomplete, a Consent Mode update with ad_storage: denied or affilyflow.consent(false)) – never because the banner hasn't read its own cookie yet.
• If you set window.affilyflowConsent later than 10 seconds after load, call affilyflow.consent(true) instead.

See Consent and cookies for the setup.

Neutral addresses and your own proxy

Ad blockers like to remove files and calls with "track" in the name. So the script sends its calls to neutral addresses next to itself:

The old addresses keep working. If the store serves the script from its own domain through a proxy – e.g. https://shop.com/af/s.js forwarded to https://app.affilyflow.com/ – all calls go through the store's domain too, so an ad blocker only sees the store's own addresses. Snippets for nginx, Apache and Next.js are in Tracking from your server.

Leads without code

For lead programs the script can report a lead by itself when the customer reaches the thank-you page. Put the address in data-lead-url and remove async, so the lead is sent before the thank-you page possibly redirects.

<script src="https://app.affilyflow.com/track.js" data-store="DIN_BUTIK" data-lead-url="/thanks"></script>

• /thanks matches /thanks and /thanks/…, but not /thanksgiving.
• A full URL (https://shop.com/thanks) is read as its path.
• If parameters are given (/thanks?type=lead), all of them must be in the page's URL.
• The front page alone (/) only matches when parameters are given too.
• The lead is reported once per session and only with an affiliate click in the browser.

Console errors

track.js only writes to the browser console when a sale from the sale line or Google Analytics could not be reported:

What each response from the server means is in Status codes. See Testing and troubleshooting to test the whole chain with the test link.

Safari and iPhone

Safari (ITP) deletes cookies and localStorage set from JavaScript after about 7 days without a visit to the site. track.js rewrites its storage on every visit, but cannot and should not get around the limits. Only a cookie set by the store's own server – such as the WooCommerce plugin or your own server – lives longer. This applies to every network, not just Affilyflow.

Legacy direct links

Links with ?aff= (or ?aff_id=) and ?store= instead of ?afid= still work. The script counts the click and stores af_aff and af_store. data-store always wins over ?store= in the URL, so a store that uses ?store= itself doesn't get its sales rejected.

Stripe Payment Links

If the page has links to buy.stripe.com, the script adds the click id to them as client_reference_id – on load and again the moment a link is clicked, so links rendered later get it too. Only when a click is stored, and never on top of a client_reference_id you set yourself. The Stripe webhook then sees the sale without any server code.