Your own auth (signed protocol)

Your auth server calls Referalli while it creates the user: full control, fraud signals, aliases and data-subject requests.

Connect

Create the connection with {"provider": "custom", "programId": "prg_…"}, then call POST /v1/auth/connections/{id}/signups from your server as you create each user, signed with x-referalli-signature (v1 or v2) and a unique x-referalli-id.

The rest of the protocol (/users, /signals, /aliases, /partners, /erase, /export, /ping) is described in the signed protocol.

Referral context

On your sign-up page, with the tracking script loaded, window.aff.getReferral() returns the visitor's referral. Put it where this provider carries it (below), under the default keys referalli_anon_id, referalli_click_id and referalli_coupon. The older referally_* spellings are still read. Referalli never links users by email: without these keys a sign-up is not attributed.

For Your own auth (signed protocol) the referral is read from: referral.code, referral.anonId, referral.clickId (with consent).

Check it

Each webhook delivery is answered with what Referalli did per user (attributed, partnerId, matchedVia, or the reason it wasn't); signed-protocol calls take "test": true on /signups to see the answer without storing anything. Every connector is held to the same conformance suite.