Integrations
How conversion tracking works, and everything your account needs to run it.
Set up the pixel
Report conversions straight from your website. Three steps: pick a browser key, paste one snippet site-wide, then verify with a test event.
Get a public token
The pixel is keyed by a public token — a browser key identifying your company. It is visible in your page source by design (not a secret) and re-viewable any time.
Install the snippet
One snippet, pasted site-wide — it loads influence360.js, captures the ref id from the creator's link and reports conversions.
- Paste the snippet below on every page (e.g. in your site layout or
<head>). It loads influence360.js and runsinfluence360('init', …)to capture the ref id. - On each conversion success page, call
influence360('track', '<EVENT_TYPE>', …)with the matching event type — pass yourdedupKey, plus the event's own field where it has one (orderValuefor a purchase,depositValuefor a deposit,qualifyingPlanfor a subscription). - To send events through your own first-party proxy or a regional collector, change the
collectUrlpassed toinit.
SIGN_UPA new user registers on your product.
No event-specific fields — content carries only its type
<script>
!(function(w,d){w.influence360=w.influence360||function(){(w.influence360.q=w.influence360.q||[]).push(arguments)};var s=d.createElement('script');s.async=1;s.src='https://tracking-pixel.influence360.io/v1/influence360.js';d.head.appendChild(s)})(window,document);
// Run on every page — captures the ref id from the destination URL.
influence360('init', '<YOUR_PUBLIC_TOKEN>', { collectUrl: 'https://tracking.influence360.io/public/pixel/conversion' });
// Run on a conversion success page.
influence360('track', 'SIGN_UP', { dedupKey: '<your-company>:sign_up:<order-or-user-id>' });
</script>Request fields
The common fields sit at the top level of the request; the event-specific ones go inside the content object, selected by its type. There is no top-level event field.
| Field | Description |
|---|---|
refIdRequired | The ref id captured from the creator's link — the campaign and creator are resolved from it. |
contentRequired | The event-specific object. Its type field selects the event and gates which other fields it carries — see the event details above. |
publicTokenRequired | Your public token (browser key), sent as the ?publicToken= query parameter on the request URL — not in the JSON body. Identifies your company and is checked against the token's allowed domains. |
dedupKeyRecommended | Your id for this conversion. A key is global and permanent, so build it from your company, the event type and your order or user id (e.g. acme:purchase:1001). Required on the postback — it is what makes retries safe; strongly recommended on the pixel. |
testOptional | Marks a verification canary: checked on receipt but never matched to a campaign or billed. See “How a conversion is credited” for what it does not check. |
clientEventAtMsOptional | Optional epoch-millis timestamp of when your side observed the event. Diagnostic only — we record the authoritative time on receipt, so it never affects billing or attribution; it just helps you spot delivery lag on queued or retried events. |
eventSourceUrlOptional | The page URL the event fired on. The pixel script captures it automatically — you only set it yourself when posting to the pixel endpoint directly. Diagnostic only; never used for billing or attribution. |
Money values inside content are strings, e.g. "49.99" — the same in the pixel's JS API and in the postback body.
Integrate with an AI assistant
Prefer to delegate? Paste this prompt into your AI coding assistant — it describes this integration end to end: the endpoint, every event type and the exact request body.
Run `claude` in your project, then paste this prompt.
I'm integrating Influence360 Performance conversion tracking into my website using the browser pixel. Generate the code for my stack and explain where each piece goes.
CONTEXT
- A creator link sends a visitor to my site with an Influence360 ref id in the destination URL. The pixel below captures and persists it automatically (first-party cookie), so I only report the conversion event.
SETUP — load the pixel (influence360.js) once on every page:
<script>
!(function(w,d){w.influence360=w.influence360||function(){(w.influence360.q=w.influence360.q||[]).push(arguments)};var s=d.createElement('script');s.async=1;s.src='https://tracking-pixel.influence360.io/v1/influence360.js';d.head.appendChild(s)})(window,document);
influence360('init', '<YOUR_PUBLIC_TOKEN>', { collectUrl: 'https://tracking.influence360.io/public/pixel/conversion' }); // every page — captures the ref id
</script>
REPORT — on each conversion success page, call (use the matching event type):
- SIGN_UP — a new user registered
influence360('track', 'SIGN_UP', { dedupKey: '<your-company>:sign_up:<order-or-user-id>' });
- KYC_VERIFICATION — a user passed identity verification
influence360('track', 'KYC_VERIFICATION', { dedupKey: '<your-company>:kyc_verification:<order-or-user-id>' });
- APP_INSTALL — a user installed the app
influence360('track', 'APP_INSTALL', { dedupKey: '<your-company>:app_install:<order-or-user-id>' });
- PURCHASE (orderValue required) — a paid order (orderValue = order amount)
influence360('track', 'PURCHASE', { dedupKey: '<your-company>:purchase:<order-or-user-id>', orderValue: '49.99' });
- DEPOSIT (depositValue required) — a funded deposit (depositValue = deposit amount)
influence360('track', 'DEPOSIT', { dedupKey: '<your-company>:deposit:<order-or-user-id>', depositValue: '49.99' });
- SUBSCRIPTION (qualifyingPlan required) — a paid subscription (qualifyingPlan = the plan the user subscribed to; payout is plan-driven)
influence360('track', 'SUBSCRIPTION', { dedupKey: '<your-company>:subscription:<order-or-user-id>', qualifyingPlan: 'pro-monthly' });
NOTES
- influence360('init', ...) must run on every page so the ref id is captured site-wide.
- To route events through your own proxy or a regional/staging collector, change collectUrl.
- dedupKey (built as <my-company>:<event-type>:<order-or-user-id>, see below) makes retries idempotent — always send it. Omitting it on the pixel disables duplicate protection entirely, so a double-submitted checkout counts twice.
- Monetary events must send their type-specific amount field (PURCHASE → orderValue, DEPOSIT → depositValue); it has to meet the action's configured minimum or the conversion is rejected.
- PREFER THE SERVER POSTBACK FOR PURCHASE AND DEPOSIT if my backend can report them: an amount reported from the browser is whatever the page sends (a visitor can edit it), the pixel cannot reverse a conversion after a refund or chargeback, and the pixel endpoint answers 204 to any well-formed request so a rejected event is indistinguishable from an accepted one. Use the pixel for the events that carry no amount (SIGN_UP, KYC_VERIFICATION, APP_INSTALL, SUBSCRIPTION). If you wire a purchase or deposit through the pixel anyway, tell me why and flag it in your summary.
- SUBSCRIPTION must send qualifyingPlan (the plan the user subscribed to); its payout is decided by matching that plan against the action's configured plan tiers — an unlisted plan is rejected — so it carries no amount.
- Web3 events (WALLET_ACTIVITY, TOKEN_ACQUISITION, DEPOSIT_STAKE, NFT_MINT) are DETECTED on-chain — you never report them — but they still need the visitor's wallet tied to the referral, which does take client code: call influence360('identify', '<connected-wallet-address>', { chain: 'ETHEREUM' }) right after the wallet connects. Without that binding (or an on-chain referral tag) an on-chain conversion has nothing to attribute and is never credited.
- THE EVENT TYPES ABOVE ARE THE COMPLETE CATALOG — there are no custom event types, and an unknown content.type is refused (postback) or silently dropped (pixel). If I need to pay for a milestone that is not in the list, map it onto the event whose pricing fits — a flat fee: any of SIGN_UP, KYC_VERIFICATION, APP_INSTALL; a fee per named level: SUBSCRIPTION with the level as qualifyingPlan; a fee graded by an amount: PURCHASE, DEPOSIT — and tell me which one you chose and why. Never invent a type.
- A campaign carries at most one action per event type, and a conversion is matched to it by its type alone, so the same type cannot be paid at two prices in one campaign.
- dedupKey IS GLOBAL AND PERMANENT: a key that was already accepted is rejected as a duplicate whichever company, campaign or event type accepted it, and even after that conversion was reversed. Build every key as <my-company>:<event-type>:<id> (e.g. acme:deposit:order-1001) so it is unique to what should pay once, give a repeat purchase or re-subscription a new key, and send the same key only on a retry of the same event. On an action marked new users only the key is also the user's identity (compared across all of my company's campaigns), so there build it from the user id (e.g. acme:deposit:user-42). Tell me which ids you chose. Without a dedupKey there is no duplicate protection.
- The pixel answering 204 (it does for any well-formed request) means RECEIVED, not credited: amount tiers, plan ids, the campaign's actions, new-users-only, the attribution window and fraud burst limits (more than 20 events per ref id or 50 per IP within 60 seconds) are applied afterwards and the outcome is not reported back. On the postback the per-IP limit counts MY SERVER's address, so keep bulk sends and backfills under 50 requests a minute per outbound IP. A test event (test: true) is never matched to a campaign, so an accepted test does not prove any of those will pass — list them in your summary as things for me to confirm in the campaign's configuration.Transparency & verification
influence360.js is the script that reports conversions from your site. This page covers what it does, what it stores, what it never does, and how to verify it.
What leaves your page
One request, to one host, carrying the fields below and nothing else. The script is loaded from our CDN and reports conversions to the collector; it makes no other network call.
- Reports to
POST https://tracking.influence360.io/public/pixel/conversion- Content type
text/plain;charset=UTF-8- Script loaded from
https://tracking-pixel.influence360.io/v1/influence360.js- Reads from the URL
?influence360RefId=
What it stores in the browser
Three writes, all first-party on your own domain. This list is complete — if you find a fourth in your browser's Application tab, that is a bug and we want the report.
| Name | Lifetime | Scope | Purpose |
|---|---|---|---|
_influence360_ref_idCookie | 90 days | Your domain, all paths | The referral id the visitor arrived with, so a conversion can be credited to the creator who sent them. |
_influence360_ref_idlocalStorage | until cleared | Your origin | A copy of the same referral id, so attribution survives the cookie being evicted. Not a second identifier — same key, same value. |
__influence360_dCookie | transient | Candidate parent domain | Written and deleted within the same call, to find the widest domain that accepts a cookie so a click on one subdomain converts on another. Never persists. |
The referral cookie is written with Path=/; SameSite=Lax; Secure — first-party, sent only over HTTPS, and not sent on cross-site requests.
Nothing is written to a domain other than yours, and nothing is read that the script did not write. If you set the cookieDomain option, the cookie is scoped to exactly that domain instead of the auto-detected one.
What it does not do
Each of these is a property of the bundle you can confirm yourself: search the source for the API it would have to call, and it is not there.
- No device fingerprintingNo canvas, font, WebGL or audio probing, no screen or hardware enumeration, no attempt to identify a device across sites.
- Reads only what it wroteIt reads its own referral cookie and its own localStorage key. It does not enumerate your cookies, storage or session data.
- No page contentNo form fields, no keystrokes, no clipboard, no DOM scraping, no session recording, no screenshots.
- No third-party callsThe only request it makes is the conversion beacon to the collector shown above. No ad networks, no analytics vendors, no tag loaders, no dynamically injected scripts.
- No cross-site trackingStorage is first-party on your domain only. There is no third-party cookie, no iframe, no cross-site identifier, and no advertising id.
- No personal data we chooseThe only field that could carry personal data is the dedupKey your own code supplies. Send an order id or a hash, prefixed with your company and the event type (e.g. acme:purchase:1001) — the pixel neither reads nor infers an email, a name or an address on its own.
What happens when it fails
The honest answer to “will this break my checkout?”, with the mechanism behind each guarantee named so you can check it rather than take it.
- It never throws into your pageEvery entry point is wrapped, including storage access and the network call. A failure inside the tracker cannot become an exception in your own code.
- It never blocks renderingThe snippet loads the script asynchronously, and conversions are sent fire-and-forget through sendBeacon (or a keepalive fetch). Nothing waits on a response, and there is no response to wait for.
- Blocked storage is not an errorIn private mode, with storage disabled, or under a sandbox, reads and writes fail silently. Attribution is lost for that visitor; the page is unaffected.
- A tampered build fails closedIf you pin a version with an integrity hash, a browser that receives different bytes refuses to execute them. The worst case is no tracking, never wrong tracking or unexpected code.
Verify the bytes you load
Pinned builds are immutable and never republished with different bytes, so a hash that matched yesterday still matches today. The manifest is the authoritative record of what we have published.
Open the published manifest ↗Published builds
The published-build list could not be loaded. The manifest linked above is the authoritative record.
1. Hash what the CDN served you
Needs nothing but curl. Proves the file your visitors receive is the file listed in the manifest — the same sha384 a pinned snippet carries.
curl -s https://tracking-pixel.influence360.io/manifest.json
curl -sO https://tracking-pixel.influence360.io/v<version>/influence360.js
openssl dgst -sha384 -binary influence360.js | openssl base64 -A2. Check the build provenance
Every published build carries a sigstore attestation binding its digest to the workflow, repository and commit that produced it. Proves the bytes came out of our public build pipeline and not from someone with CDN access.
curl -sO https://tracking-pixel.influence360.io/v<version>/influence360.js
gh attestation verify influence360.js --repo Influence360/tracking-pixel3. Rebuild it yourself
The build is reproducible: rebuilding the commit shown in the Commit column above produces byte-identical output. The command prints a sha256 — compare it with the one in the table. This is the check that requires trusting nobody: not us, and not GitHub.
git clone https://github.com/Influence360/tracking-pixel
cd tracking-pixel && git checkout <commit>
npm ci && npm run verify:reproducible
# prints "build is reproducible: sha256-…" — compare it with the manifestBuilds from this repository are signed by public sigstore and recorded in its public Rekor transparency log, so the attestation is independently auditable: you can confirm the bytes came out of this repository's workflow without taking our word for it, or GitHub's. Verified on the current build — the signing certificate is issued by sigstore.dev, and the Rekor entry is retrievable anonymously with a signed inclusion proof. Builds published before this repository became public on 5 August 2026 were signed by GitHub's own sigstore instance instead and carry no public log entry. Step 3 goes further still, tying those bytes to source you can read.
Staying informed, and reporting a problem
A pinned version never changes under you. If you use the auto-update channel, or your script-monitoring tool alerts on a change, these are how you correlate and how you reach us.
- Published-builds feed (Atom)
- One dated entry per published build, with its hashes and the commit it was built from. Subscribe with a feed reader or your monitoring tool; there is no email list.
- Report a vulnerability
- Opens a private draft advisory on the repository. We acknowledge within three business days. Please do not open a public issue for a security problem.
- Privacy Policy
- Retention, international transfers and the rest of our data-protection commitments, including for data collected through conversion tracking.