Changelog

Dated changes to the Referalli API, SDKs, tracking script and webhooks: renames, new versions, removals and anything that needs action on your side.

Embed
Preview of the card
<a href="https://referalli.com/docs/changelog"><img src="https://referalli.com/docs/_api/public/orgs/07f432f4-34b9-46a7-aaad-c0e395d2e4f9/spaces/2bf4f614-3630-4fbf-85f9-5ecafa6b7d97/pages/2de60a4a-3063-435a-9db8-5dc8c97120c1/social-card.svg?v=3e7ae33eec8b" alt="Changelog" width="600" height="315"></a>

Newest first. Entries marked Action needed change something you may rely on. Removals are announced here at least 90 days before they happen.

Upcoming

  • 2027-01-31: the referally_ctx cookie twin stops. Action needed if you read the attribution cookie yourself: read referalli_ctx, falling back to referally_ctx until then. See Renamed from Referally.

2026-10-25

  • Program click windows are capped at 400 days. cookieWindowDays now accepts 1 to 400 (it was 1 to 730). Browsers don't keep a cookie longer than 400 days, so a longer window could never be backed by the tracking cookie. No existing program used more than 400.

  • Docs: this changelog and Renamed from Referally.

2026-10-24

  • SDKs 0.2.0 on npm (referalli, @referalli/react, @referalli/next, @referalli/express, @referalli/react-native, @referalli/cli, @referalli/mcp), PyPI and Go, and as tags for Swift, Kotlin and Android (Kotlin and Android install from JitPack, with build provenance on the GitHub release). It covers API version 2026-11-01: 56 new operations, the webhook_endpoint.failing and webhook_endpoint.recovered topics, and the reauth_required error.

  • Tracking script consent: aff.js follows the merchant's consent manager: Cookie Munch, IAB TCF v2.2 and GPP, Google Consent Mode v2, OneTrust, Cookiebot, Usercentrics, Didomi, Osano, Termly, or a callback of your own. See Tracking consent.

  • Data-rights requests follow Cookie Munch's v2 executor contract (X-Version: 2 on /api/privacy/*). v1 calls keep working.

  • Removed: GET /.well-known/forgedeck-embed.json and GET /v1/embed. Action needed only if you called getEmbed in an SDK: it's gone in 0.2.0. Referalli publishes its own manifest at /.well-known/referalli-embed.json.

  • Security: enterprise SSO sessions are now scoped to the organization they signed in through, so one organization's identity provider no longer satisfies another organization's "require SSO".

2026-10-22

  • Referally is now Referalli. Every integrator-facing name was renamed, and the old names keep working. Action needed if you read any of them directly: see Renamed from Referally.

Updated