---
name: acp-affiliate-attribution
description: Implement ACP affiliate attribution — privacy-preserving affiliate tracking without cookies using token-based first-touch and last-touch attribution. Use when building affiliate programs, referral tracking, or partnership attribution.
allowed-tools: Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch
---

# ACP Affiliate Attribution

## Before writing code

**Fetch live docs**:
1. Web-search `site:github.com agentic-commerce-protocol rfcs affiliate_attribution` for the affiliate attribution RFC
2. Fetch `https://developers.openai.com/commerce/specs/checkout/` for how attribution integrates with checkout
3. Web-search `site:github.com agentic-commerce-protocol spec json-schema affiliate` for the schema

## Conceptual Architecture

### What Affiliate Attribution Does

ACP's affiliate attribution extension provides **privacy-preserving affiliate tracking without cookies**. It replaces traditional cookie-based tracking with structured tokens that respect buyer privacy while enabling fair commission attribution.

### Key Properties

- **Write-only** — Attribution data is sent to the merchant but NEVER echoed back in responses. This prevents information leakage.
- **Privacy-preserving** — No third-party cookies, no cross-site tracking, no browser fingerprinting
- **Token-based** — Attribution uses opaque tokens rather than personally identifiable data
- **Two attribution models**: First-touch and last-touch

### Attribution Models

| Model | Description |
|-------|-------------|
| **First-touch** | Credit goes to the first affiliate that referred the buyer |
| **Last-touch** | Credit goes to the most recent affiliate before purchase |

### How It Works

1. Affiliate generates a tracking token (opaque identifier)
2. When buyer clicks affiliate link, the agent receives the attribution token
3. Agent includes first-touch attribution data on create (`POST /checkout_sessions`) and last-touch attribution data on complete (`POST /checkout_sessions/{id}/complete`)
4. Merchant receives attribution and records it for commission processing
5. Merchant NEVER returns attribution in responses (write-only)

### Data Flow

```
Affiliate → Token → Agent → Checkout Session (attribution field) → Merchant
                                                                      ↓
                                                              Commission Processing
```

### Privacy Compliance

- No PII in attribution tokens
- Tokens are opaque — cannot be reverse-engineered to identify individuals
- Write-only prevents downstream data leakage
- Compliant with GDPR/CCPA by design
- No cross-session tracking without buyer consent

### Extension Negotiation

Like all extensions, affiliate attribution must be negotiated:
1. Agent includes `affiliate_attribution` in `capabilities.extensions[]`
2. Merchant confirms support
3. Only then is attribution data included in requests

### Use Cases

- Affiliate marketing programs
- Influencer referral tracking
- Partnership commission attribution
- Referral program management
- Marketing channel attribution

### Best Practices

- Generate unique, opaque tokens per affiliate
- Support both first-touch and last-touch models
- Process attribution asynchronously — don't block checkout
- Never echo attribution data in responses (enforce write-only)
- Build commission reports from stored attribution data
- Test with multiple attribution scenarios (direct, single affiliate, multiple affiliates)

Fetch the affiliate attribution RFC for exact token format, attribution object structure, and write-only enforcement rules before implementing.