Install tracking

1. Install the snippet

Paste this tag once, on every page of your site, ideally just before </head>. It loads asynchronously and never throws inside your page.

<script async src="https://amblify-backend.guud.ai/track.js"></script>

Because your brand is guud-owned, the tag above pre-binds your brand slug () so the same tag works on every one of your sites.

What it does

• Reads ?amb=<username> from the landing URL. Every link an ambassador shares for you carries it.
• Stores the username in a first-party cookie named amb_ref for 30 days. First touch wins: the ambassador who brought a visitor first keeps the credit.
• Beacons one visit per session to Amblify. Bot traffic and non-US visitors are dropped server-side, and repeat visits from the same device are deduplicated per day.
• Exposes window.amblify with ambassador and customId so your checkout can read who referred the customer.

No API key is needed in the browser. The snippet is public and safe to ship on any page.

2. Test a tracked link

Open your site with an amb parameter, then check the cookie in your browser's dev tools. Use any real ambassador username, or your own if you also have a creator account.

https://your-site.com/?amb=creator_username

document.cookie.match(/amb_ref=([^;]*)/)?.[1]   // → "creator_username"
window.amblify                                    // → { brand, ambassador, customId }

Visits only count from US IP addresses in a real browser. Automated browsers and headless tools are ignored, so use a normal browser tab to test.

3. Report conversions from your server

When an order completes, read the amb_ref cookie (or the amb value you saved at checkout) and call the conversion endpoint from your server. Amblify looks up the ambassador's commission bounty with your brand, computes the commission owed, and adds it to your monthly invoice.

Option A: bearer token (simplest)

Send your secret track key as a bearer token. Keep the key in your server's environment, never in a page.

curl -X POST https://amblify-backend.guud.ai/api/track/conversion \
  -H "Authorization: Bearer $AMBLIFY_TRACK_KEY" \
  -H "Content-Type: application/json" \
  -d '{"order_id":"ORD-10042","amount":49.99,"amb":"creator_username"}'

Option B: signed request (key never leaves your server)

Send your public brand slug plus an HMAC-SHA256 signature of the exact request body, computed with your track key. Amblify verifies the signature so the key itself is never transmitted.

const crypto = require('node:crypto');

async function reportConversion({ orderId, amount, amb, campaignId }) {
  const body = JSON.stringify({ order_id: orderId, amount, amb, campaign_id: campaignId });
  const signature = crypto
    .createHmac('sha256', process.env.AMBLIFY_TRACK_KEY)
    .update(body)
    .digest('hex');

  const res = await fetch('https://amblify-backend.guud.ai/api/track/conversion', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-Amblify-Brand': process.env.AMBLIFY_BRAND_KEY,   // your public brand slug
      'X-Amblify-Signature': 'sha256=' + signature,
    },
    body,
  });
  return res.json(); // { ok, conversion: { attributed, commission, duplicate?, ... } }
}

$body = json_encode(['order_id' => $orderId, 'amount' => $amount, 'amb' => $_COOKIE['amb_ref'] ?? null]);
$sig  = hash_hmac('sha256', $body, getenv('AMBLIFY_TRACK_KEY'));

$ch = curl_init('https://amblify-backend.guud.ai/api/track/conversion');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_POSTFIELDS => $body,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    'Content-Type: application/json',
    'X-Amblify-Brand: ' . getenv('AMBLIFY_BRAND_KEY'),
    'X-Amblify-Signature: sha256=' . $sig,
  ],
]);
$result = json_decode(curl_exec($ch), true);

Responses

• 201 with conversion.attributed: true and the commission owed, when the ambassador has a verified commission bounty with you.
• 201 with attributed: false and reason: no_commission_claim when they do not. The sale is still recorded, nothing is owed.
• 200 with duplicate: true when you resend an order_id already reported.
• 401 / 403 when the key or signature is wrong. 404 when amb is not a known ambassador.

Running the always-on affiliate program (signups, subscription payments, refunds)? Send event bodies to the same endpoint with the same auth: see Affiliate events in the API docs.

Selling with PayPal buttons or subscriptions?

You can skip step 3. Pass the value the snippet exposes as window.amblify.customId into your PayPal button's custom_id, and Amblify's PayPal webhook credits the ambassador on every completed sale and each subscription renewal.

paypal.Buttons({
  createOrder: (data, actions) => actions.order.create({
    purchase_units: [{
      amount: { value: '49.99' },
      custom_id: (window.amblify && window.amblify.customId) || undefined, // "amb=<username>;brand=<your-slug>"
    }],
  }),
}).render('#paypal-button');

For subscriptions, set the same value as custom_id on actions.subscription.create. Renewals are credited every billing cycle for as long as the subscription stays active.

Your PayPal setup

Selling on Shopify?

You can skip step 3 here too. Add one Shopify webhook and Amblify credits the referring ambassador on every paid order. The ambassador is read from a cart attribute named amb_ref (copy the snippet's cookie into it from your theme) or, failing that, from the ?amb= on the landing URL Shopify recorded.

Selling on WooCommerce?

Same deal as Shopify: skip step 3 and add one WooCommerce webhook. Amblify credits the referring ambassador when an order turns Processing or Completed; later edits of the same order are ignored, so a sale is never counted twice. The ambassador is read from an order meta field named amb_ref (have your checkout copy the snippet's amb_ref cookie into it).

…