Integrations

How conversion tracking works, and everything your account needs to run it.

Set up the pixel

~5 min setup

Report conversions straight from your website. Three steps: pick a browser key, paste one snippet site-wide, then verify with a test event.

The values in angle brackets are placeholders. Sign in and the guide fills in your real endpoints and tokens.
1

Get a public token

The pixel is keyed by a public token — a browser key identifying your company. It is visible in your page source by design (not a secret) and re-viewable any time.

2

Install the snippet

One snippet, pasted site-wide — it loads influence360.js, captures the ref id from the creator's link and reports conversions.

  1. Paste the snippet below on every page (e.g. in your site layout or <head>). It loads influence360.js and runs influence360('init', …) to capture the ref id.
  2. On each conversion success page, call influence360('track', '<EVENT_TYPE>', …) with the matching event type — pass your dedupKey, plus the event's own field where it has one (orderValue for a purchase, depositValue for a deposit, qualifyingPlan for a subscription).
  3. To send events through your own first-party proxy or a regional collector, change the collectUrl passed to init.
Sign-up (SIGN_UP)
site-wide-snippet.html
<script>
  !(function(w,d){w.influence360=w.influence360||function(){(w.influence360.q=w.influence360.q||[]).push(arguments)};var s=d.createElement('script');s.async=1;s.src='https://tracking-pixel.influence360.io/v1/influence360.js';d.head.appendChild(s)})(window,document);

  // Run on every page — captures the ref id from the destination URL.
  influence360('init', '<YOUR_PUBLIC_TOKEN>', { collectUrl: 'https://tracking.influence360.io/public/pixel/conversion' });

  // Run on a conversion success page.
  influence360('track', 'SIGN_UP', { dedupKey: '<your-order-or-user-id>' });
</script>

Verify with a test event

Fire a verification canary (never billed) from the Configuration tab — we confirm your integration automatically once it lands.

Or delegate the work

Integrate with an AI assistant

Prefer to delegate? Paste this prompt into your AI coding assistant — it describes this integration end to end: the endpoint, every event type and the exact request body.

Select your client

Run `claude` in your project, then paste this prompt.

integration-prompt.md
I'm integrating Influence360 CPA conversion tracking into my website using the browser pixel. Generate the code for my stack and explain where each piece goes.

CONTEXT
- An influencer link sends a visitor to my site with an Influence360 ref id in the destination URL. The pixel below captures and persists it automatically (first-party cookie), so I only report the conversion event.

SETUP — load the pixel (influence360.js) once on every page:
   <script>
     !(function(w,d){w.influence360=w.influence360||function(){(w.influence360.q=w.influence360.q||[]).push(arguments)};var s=d.createElement('script');s.async=1;s.src='https://tracking-pixel.influence360.io/v1/influence360.js';d.head.appendChild(s)})(window,document);
     influence360('init', '<YOUR_PUBLIC_TOKEN>', { collectUrl: 'https://tracking.influence360.io/public/pixel/conversion' });  // every page — captures the ref id
   </script>

REPORT — on each conversion success page, call (use the matching event type):
   - SIGN_UP — a new user registered
     influence360('track', 'SIGN_UP', { dedupKey: '<your-order-or-user-id>' });
   - KYC_VERIFICATION — a user passed identity verification
     influence360('track', 'KYC_VERIFICATION', { dedupKey: '<your-order-or-user-id>' });
   - APP_INSTALL — a user installed the app
     influence360('track', 'APP_INSTALL', { dedupKey: '<your-order-or-user-id>' });
   - PURCHASE (orderValue required) — a paid order (orderValue = order amount)
     influence360('track', 'PURCHASE', { dedupKey: '<your-order-or-user-id>', orderValue: '49.99' });
   - DEPOSIT (depositValue required) — a funded deposit (depositValue = deposit amount)
     influence360('track', 'DEPOSIT', { dedupKey: '<your-order-or-user-id>', depositValue: '49.99' });
   - SUBSCRIPTION (qualifyingPlan required) — a paid subscription (qualifyingPlan = the plan the user subscribed to; payout is plan-driven)
     influence360('track', 'SUBSCRIPTION', { dedupKey: '<your-order-or-user-id>', qualifyingPlan: 'pro-monthly' });

NOTES
- influence360('init', ...) must run on every page so the ref id is captured site-wide.
- To route events through your own proxy or a regional/staging collector, change collectUrl.
- dedupKey (a stable order/user id) makes retries idempotent — always send it. Omitting it on the pixel disables duplicate protection entirely, so a double-submitted checkout counts twice.
- Monetary events must send their type-specific amount field (PURCHASE → orderValue, DEPOSIT → depositValue); it has to meet the action's configured minimum or the conversion is rejected.
- PREFER THE SERVER POSTBACK FOR PURCHASE AND DEPOSIT if my backend can report them: an amount reported from the browser is whatever the page sends (a visitor can edit it), the pixel cannot reverse a conversion after a refund or chargeback, and the pixel endpoint always answers 204 so a rejected event is indistinguishable from an accepted one. Use the pixel for the events that carry no amount (SIGN_UP, KYC_VERIFICATION, APP_INSTALL, SUBSCRIPTION). If you wire a purchase or deposit through the pixel anyway, tell me why and flag it in your summary.
- SUBSCRIPTION must send qualifyingPlan (the plan the user subscribed to); its payout is decided by matching that plan against the action's configured plan tiers — an unlisted plan is rejected — so it carries no amount.
- Web3 events (WALLET_ACTIVITY, TOKEN_ACQUISITION, DEPOSIT_STAKE, NFT_MINT) are DETECTED on-chain — you never report them — but they still need the visitor's wallet tied to the referral, which does take client code: call influence360('identify', '<connected-wallet-address>', { chain: 'ETHEREUM' }) right after the wallet connects. Without that binding (or an on-chain referral tag) an on-chain conversion has nothing to attribute and is never credited.

Transparency & verification

influence360.js is the script that reports conversions from your site. This page covers what it does, what it stores, what it never does, and how to verify it.

What leaves your page

One request, to one host, carrying the fields below and nothing else. The script is loaded from our CDN and reports conversions to the collector; it makes no other network call.

Reports to
POST https://tracking.influence360.io/public/pixel/conversion
Content type
text/plain;charset=UTF-8
Script loaded from
https://tracking-pixel.influence360.io/v1/influence360.js
Reads from the URL
?influence360RefId=
See every field in the event reference →

What it stores in the browser

Three writes, all first-party on your own domain. This list is complete — if you find a fourth in your browser's Application tab, that is a bug and we want the report.

NameLifetimeScopePurpose
_influence360_ref_idCookie
90 daysYour domain, all pathsThe referral id the visitor arrived with, so a conversion can be credited to the creator who sent them.
_influence360_ref_idlocalStorage
until clearedYour originA copy of the same referral id, so attribution survives the cookie being evicted. Not a second identifier — same key, same value.
__influence360_dCookie
transientCandidate parent domainWritten and deleted within the same call, to find the widest domain that accepts a cookie so a click on one subdomain converts on another. Never persists.
About these writes

The referral cookie is written with Path=/; SameSite=Lax; Secure — first-party, sent only over HTTPS, and not sent on cross-site requests.

Nothing is written to a domain other than yours, and nothing is read that the script did not write. If you set the cookieDomain option, the cookie is scoped to exactly that domain instead of the auto-detected one.

What it does not do

Each of these is a property of the bundle you can confirm yourself: search the source for the API it would have to call, and it is not there.

  • No device fingerprintingNo canvas, font, WebGL or audio probing, no screen or hardware enumeration, no attempt to identify a device across sites.
  • Reads only what it wroteIt reads its own referral cookie and its own localStorage key. It does not enumerate your cookies, storage or session data.
  • No page contentNo form fields, no keystrokes, no clipboard, no DOM scraping, no session recording, no screenshots.
  • No third-party callsThe only request it makes is the conversion beacon to the collector shown above. No ad networks, no analytics vendors, no tag loaders, no dynamically injected scripts.
  • No cross-site trackingStorage is first-party on your domain only. There is no third-party cookie, no iframe, no cross-site identifier, and no advertising id.
  • No personal data we chooseThe only field that could carry personal data is the dedupKey your own code supplies. Send a hash or an order id — the pixel neither reads nor infers an email, a name or an address on its own.

What happens when it fails

The honest answer to “will this break my checkout?”, with the mechanism behind each guarantee named so you can check it rather than take it.

  • It never throws into your pageEvery entry point is wrapped, including storage access and the network call. A failure inside the tracker cannot become an exception in your own code.
  • It never blocks renderingThe snippet loads the script asynchronously, and conversions are sent fire-and-forget through sendBeacon (or a keepalive fetch). Nothing waits on a response, and there is no response to wait for.
  • Blocked storage is not an errorIn private mode, with storage disabled, or under a sandbox, reads and writes fail silently. Attribution is lost for that visitor; the page is unaffected.
  • A tampered build fails closedIf you pin a version with an integrity hash, a browser that receives different bytes refuses to execute them. The worst case is no tracking, never wrong tracking or unexpected code.

Verify the bytes you load

Pinned builds are immutable and never republished with different bytes, so a hash that matched yesterday still matches today. The manifest is the authoritative record of what we have published.

Open the published manifest ↗

Published builds

The published-build list could not be loaded. The manifest linked above is the authoritative record.

1. Hash what the CDN served you

Needs nothing but curl. Proves the file your visitors receive is the file listed in the manifest — the same sha384 a pinned snippet carries.

hash-pixel.sh
curl -s https://tracking-pixel.influence360.io/manifest.json

curl -sO https://tracking-pixel.influence360.io/v<version>/influence360.js
openssl dgst -sha384 -binary influence360.js | openssl base64 -A

2. Check the build provenance

Every published build carries a sigstore attestation binding its digest to the workflow, repository and commit that produced it. Proves the bytes came out of our public build pipeline and not from someone with CDN access.

verify-provenance.sh
curl -sO https://tracking-pixel.influence360.io/v<version>/influence360.js
gh attestation verify influence360.js --repo Influence360/tracking-pixel

3. Rebuild it yourself

The build is reproducible: rebuilding the commit shown in the Commit column above produces byte-identical output. The command prints a sha256 — compare it with the one in the table. This is the check that requires trusting nobody: not us, and not GitHub.

rebuild-pixel.sh
git clone https://github.com/Influence360/tracking-pixel
cd tracking-pixel && git checkout <commit>
npm ci && npm run verify:reproducible

# prints "build is reproducible: sha256-…" — compare it with the manifest
What the provenance attestation proves

Builds from this repository are signed by public sigstore and recorded in its public Rekor transparency log, so the attestation is independently auditable: you can confirm the bytes came out of this repository's workflow without taking our word for it, or GitHub's. Verified on the current build — the signing certificate is issued by sigstore.dev, and the Rekor entry is retrievable anonymously with a signed inclusion proof. Builds published before this repository became public on 5 August 2026 were signed by GitHub's own sigstore instance instead and carry no public log entry. Step 3 goes further still, tying those bytes to source you can read.

Staying informed, and reporting a problem

A pinned version never changes under you. If you use the auto-update channel, or your script-monitoring tool alerts on a change, these are how you correlate and how you reach us.

Published-builds feed (Atom)
One dated entry per published build, with its hashes and the commit it was built from. Subscribe with a feed reader or your monitoring tool; there is no email list.
Report a vulnerability
Opens a private draft advisory on the repository. We acknowledge within three business days. Please do not open a public issue for a security problem.
Privacy Policy
Retention, international transfers and the rest of our data-protection commitments, including for data collected through conversion tracking.