Introduction
Third‑party‑Cookies are losing effectiveness — for merchants this means: tracking and attribution must function independently of browser cookies. Affilentra, as a self‑hosted solution, provides the technical building blocks to redirect tracking links server‑side, capture conversions server‑to‑server, and use a privacy‑compliant fingerprint fallback when devices change. This guide walks you step by step through configuration and implementation.
Overview: Architecture and Core Principles
The goal is a robust, cookieless tracking setup consisting of three layers:
- Server‑Side Redirects: Clicks are routed through your server, where Click‑IDs are generated and stored before redirecting to the destination.
- Server‑to‑Server‑Postbacks: Conversions are reported directly from your shop's order system to Affilentra; browser cookies are not required.
- Fingerprint Fallback: If no Click‑ID is available or cookies are lost, a hashed, privacy‑aware device signature match is used to attribute conversions.
- Define a tracking domain or subdomain (e.g. track.ihredomain.de) and point it to the Affilentra server via DNS (A/CNAME).
- Set up SSL/TLS for the tracking domain (letsencrypt/other), as postbacks and redirects must run over HTTPS.
- Create API‑tokens for postbacks and store them securely; these tokens are used to verify signatures for conversions.
- Prepare a development environment for test transactions.
With a self‑hosted Affilentra installation you retain control over domain, data processing, and licensing model.
Preparation: Requirements and Configuration
Before you begin, ensure the self‑hosted Affilentra instance is installed (PRO or NETWORK license), and you have admin access. Further preparation steps:
Step 1 — Set Up Server‑Side Redirects
Objective: Each affiliate click is logged server‑side and assigned a Click‑ID before the user is redirected to the shop page.
- Define tracking link format: affiliate.example.com/clk?aid={partner}&pid={produkt}&dst={zielurl}
- Generate Click‑ID: When a click arrives, your server generates a unique Click‑ID (e.g. UUID) and stores it with a timestamp, hashed User‑Agent, optionally an IP trunk, origin parameters and an optional fingerprint hash.
- Perform redirect: After logging, the server issues a 302 redirect to the destination (destination URL unmodified or with an additional parameter click_id={id} depending on shop integration). Important: Redirect must be server-side so that no third‑party cookie is required.
- Cookie strategy: Additionally set a first‑party cookie (SameSite=Lax, Secure) on your tracking domain with the Click‑ID; this is helpful if the shop resides on the same primary domain.
Note: Affilentra can serve as the destination for click capture and storage; in your self‑hosted installation enable the recording of incoming clicks and the assignment of Click‑IDs in the admin configuration.
Step 2 — Capture conversions without third‑party cookies (Server‑to‑Server)
The most reliable method in a cookieless context is a server-side postback from the shop to Affilentra.
- Define postback endpoint: After an order completes, your shop sends an HTTP(S) request to the Affilentra API with parameters: click_id (if present), amount, conversion_status, timestamp and an HMAC signature over the payload using your API token.
- Validation on Affilentra: The platform verifies the signature, existing Click‑ID and time window (e.g. Click‑TTL) and writes the conversion to the database. If click_id is missing, fingerprint fallback is used (see Step 3).
- Error handling: The shop side should implement retry mechanisms for failed postbacks and provide failover logs. Affilentra returns status codes in the response for successful and failed processing.
Important: Use only your API token and configure IP whitelists or rate limits in Affilentra to prevent misuse.
Step 3 — Fingerprint fallback for attribution on device change
If no Click‑ID is available (e.g. the user switches devices or cookies were deleted), a privacy-conscious fingerprint match enables secondary attribution.
- What to collect: Combination of non‑personal attributes such as browser fingerprint (hashed User‑Agent parts, screen resolution, language, timezone), optionally partially truncated IP (e.g. only /24), and a date/timestamp. Do not store direct PII fields like full IP, email or names.
- Hashing and salt: Before storage, hash all attributes with a server‑side salt and a strong hashing algorithm. Rotate the salt regularly and configure it in Affilentra.
- Matching strategy: On a conversion Affilentra should first attempt exact click_id matching; if that is missing, search for matching fingerprint hashes within a configurable time window (e.g. recommended: 7–30 days). Matching should be probabilistic and implemented with thresholds (similarity score); if multiple candidates exist, use a prioritization algorithm (most recent click, highest match).
- Transparency and opt‑out: Inform users in the privacy policy about the use of fingerprint fallbacks and offer opt‑out options.
Practical example: Conversion flow
1) Click on affiliate link → Server‑Side Redirect to shop, click_id is stored and set as a first‑party cookie.
2) Customer purchases → Shop sends postback with click_id and signature to Affilentra.
3) Affilentra verifies the signature, matches the click_id and records the conversion. If click_id is missing, fingerprint matching is triggered and an attribution is performed according to defined rules.
Testing, monitoring and billing
Execute test scenarios:
- Click → order completion on the same device (click_id present).
- Click → device change → order completion (only fingerprint matching possible).
- Faulty/delayed postbacks and signature errors.
Log click and conversion records separately by role (software operator, merchant, partner). Use Affilentra reports to reconcile payments and commission calculations; configure alerting for anomalies.
Security, privacy and operations
- Tokens and secrets: Store API tokens securely, rotate them regularly and restrict access to production systems.
- Data protection: Store fingerprints only hashed, configure limited retention periods and review the legal basis (e.g. legitimate interest). Seek legal advice if necessary.
- Cookie configuration: First‑party cookies with SameSite=Lax/Secure and appropriate lifetimes; do not depend on third‑party cookies.
Practical recommendations for merchants
- Use your own tracking domain to maximize first-party context.
- Rely on server-to-server postbacks as the primary channel for conversions; use fingerprinting only as a fallback.
- Document all postback formats and signature methods in your developer guide so partner integrations are reproducible.
- Perform regular tests and reconciliations between shop orders and Affilentra reports.
Conclusion and next step
With server-side redirects, server-to-server postbacks and a privacy-compliant fingerprint fallback, merchants can technically implement cookieless tracking with Affilentra self-hosted while retaining control over data and attribution. The described configuration reduces dependency on third-party cookies and provides a transparent basis for commission calculation and billing.
Choose a start: Learn more and begin implementation at https://affilentra.de
Next step
Try Affilentra yourself
A unified platform that transparently brings together product provisioning, tracking, conversion validation, commission calculation and payout across clearly separated roles; option for a self-hosted installation with a perpetual license and no revenue share; merchants retain control over products, terms and promotional materials; partners receive personal tracking links and a traceable payout history.