How cross-domain attribution tracks a referral click

Cross-domain attribution tracks a referral from the moment someone clicks a link on one domain to the moment they convert on another, often days later. ReferralFlo's Growth Graph stitches that gap together with a generated link, UTM passthrough, and device fingerprinting, then reconciles the result against Stripe, Shopify, or HubSpot records so a referral credit survives redirects, app switches, and delayed purchases.

What cross-domain attribution has to solve

A referral click rarely finishes on the domain where it started. The link might open on a marketing site, land on a Shopify checkout subdomain, then resolve inside a SaaS app weeks later. Cross-domain attribution has to keep the same referral identity alive across each handoff, because cookies set on one domain are invisible on the next.

Three handoffs cause most of the trouble: the jump from a landing page to a checkout, the jump from checkout to a hosted payment page, and the delay between a free signup and a paid upgrade recorded in a CRM. Each handoff is an opportunity for the referral signal to drop, which is why no single tracking mechanism covers the whole path on its own.

How ReferralFlo generates and signs a referral link

ReferralFlo's link generator creates a unique referral link per advocate, encoding a referrer ID, program ID, and a signed token that resists tampering. That link, built through the link generator or the API, carries the referral identity through every redirect until a conversion event closes the loop.

The signature matters more than it looks. Without it, anyone could forge a referral ID in a URL and claim a reward for a sale they never influenced. ReferralFlo's anti-fraud layer checks the signature on every inbound click before it ever writes an attribution record, which is part of why the link itself, not just a cookie, carries the weight of proof. The full event and webhook schema behind this is documented in ReferralFlo's docs for teams wiring up custom share flows with the SDK.

UTM passthrough and where it breaks

UTM passthrough means ReferralFlo appends utm_source, utm_medium, and a referral-specific parameter to the generated link, then carries those parameters through every redirect hop so a connected system like HubSpot still sees the original referral source. Passthrough breaks when a redirect strips query strings, or when someone shares a bare URL instead of the generated link.

The most common failure practitioners report is a copy-paste problem: a customer forwards the destination URL from their address bar instead of the original referral link, and the UTM parameters never travel with it. A second failure is a marketing redirect chain, vanity URL to landing page to checkout, that drops query parameters at one hop. Both are visible in link-click and webhook logs, not guesswork.

Device fingerprinting attribution when cookies disappear

Device fingerprinting attribution matches a click to a later conversion using signals like browser version, screen resolution, and timezone when no cookie survives the trip across domains. ReferralFlo's Growth Graph combines this fingerprint with UTM data and the signed link token, so a referral can still be credited even after a browser blocks third-party cookies outright.

That blocking is now the default, not the exception. Apple's WebKit team describes this shift in its own engineering blog, Intelligent Tracking Prevention, a policy it has tightened in nearly every release since 2017. Fingerprinting and server-side webhook matching exist precisely because a cookie that simply persists can no longer be assumed.

How conversions tie back through Stripe, Shopify, and HubSpot

ReferralFlo ties a referral to a conversion by listening for webhook events from Stripe, Shopify, and HubSpot, matching the customer or order record against the referral token captured at click. When a Stripe charge succeeds or a Shopify order completes, the webhook event triggers reward payout and updates the attribution record inside the connected integration.

The match itself runs on identifiers already present in each system: a Stripe customer ID, a Shopify order's customer email hash, or a HubSpot contact ID. Stripe's webhook documentation describes the same event-driven pattern this relies on: a signed payload fires the moment the underlying object changes state, with no polling required. ReferralFlo doesn't need a new cookie at checkout, because the webhook payload already carries the identifier the Growth Graph needs to close the loop. For a deeper look at reconciling Stripe and Shopify specifically, see Stripe-Shopify integration: reconciling referral conversions. A full list of supported systems sits on the integrations page.

Debugging an attribution gap step by step

An attribution gap usually traces to one of three points: the UTM parameters got stripped before the click reached its destination, the webhook from Stripe or Shopify never fired or arrived late, or the device fingerprint confidence score fell below the match threshold. ReferralFlo's audit log and webhook event history make each of these checkable in minutes.

Start with the link-click log before touching the webhook queue. Most gaps that look like an integration failure turn out to be a parameter that never made it past the second redirect. If attribution gaps are a recurring problem rather than a one-off, it's worth checking whether the benchmark you're comparing against has gone stale; see why referral program benchmarks go stale fast for how to tell.

Pulling it together

None of these mechanisms work in isolation. A signed link without UTM passthrough loses its source context the moment it leaves a browser's address bar. A fingerprint without a webhook has nothing to reconcile against. Cross-domain attribution is the sum of all three layers agreeing on the same customer, which is why debugging it means checking each layer in order rather than guessing at the integration.

Teams auditing this kind of setup can run a live check of click-to-conversion timing with the referral tracker, and the approvals, escrow, and audit log that sit downstream of this whole chain live in referral management software. Getting the attribution layer right is what makes those downstream numbers trustworthy in the first place.