How affiliate programs actually work — beginner's guide

How do affiliate programs work, in the version nobody bothers to write because it sounds too obvious to spell out? You share a special link, somebody clicks it, somebody buys something at the other end, and a piece of that purchase is paid to you. That sentence hides four moving parts — the link, the cookie, the attribution rule, the payout — and the difference between an affiliate scheme that pays you reliably and one that quietly drops two-thirds of your earned commissions sits in the details of those four parts. This post is the honest tour, written for someone who has never been on either side of an affiliate program and wants the mechanics before they start promoting anything. Of the four parts, the third one — attribution — is where the rules get strange enough that the way credit gets divided when a buyer touches three different referral sites deserves its own walkthrough alongside this one.

Most beginner explanations stop at "you get paid when someone buys". That is true and useless. The interesting questions start one layer down. What counts as "someone you referred" if the buyer clicked your link, then went to a competitor's link a day later, then came back? What happens when the buyer pays for a year up front and asks for a refund in month three? Why does one program pay you $15 for a sale and another pay $187 for the same sale on the same product? The answers are not opinions — they are rules, written down in the program's terms, and the rules vary enormously. By the end of this post you will know which rules to read, what the standard answers look like, and how to spot a program designed to underpay. If you're running an agency rather than promoting solo, the stack-or-pick decision for agencies covers when commission income can sit alongside retainer and reseller revenue without crossing a line with the client.

How do affiliate programs work — the four parts in order#

Every affiliate program, from Amazon Associates to a tiny indie SaaS scheme, runs on the same four-step plumbing. The names change. The plumbing does not.

Step one: the link. When you sign up for any affiliate program, you get a unique link — usually the merchant's normal product URL with a query string like ?ref=yourid or ?aff=12345, or sometimes a redirect through a tracking domain like partner.merchant.com/aff_12345. That ID identifies you. Anyone who clicks the link and ends up on the merchant's site is now associated with your account in their tracking system.

Step two: the cookie. The moment a click lands on the merchant's site, their server writes a small file in the visitor's browser — a cookie — recording your affiliate ID and a timestamp. That cookie has an expiry date set by the program, called the cookie window. Thirty days is the most common, ninety is generous, and a few programs run as short as twenty-four hours or as long as a year. While that cookie is alive, the visitor is "yours" in the merchant's tracking.

Step three: attribution. When the visitor eventually makes a purchase — minutes later, days later, weeks later — the merchant's checkout reads the cookie, sees your affiliate ID, and books the sale to your account. If the visitor clicks a different affiliate's link in the meantime, most programs follow last-click attribution: the most recent affiliate cookie wins, and yours is overwritten. A few programs use first-click. A handful run multi-touch attribution that splits the credit. Last-click is the overwhelming default — assume it unless the program explicitly says otherwise.

Step four: the payout. Earned commissions sit in a "pending" balance until the merchant has settled refund risk, usually thirty to sixty days from the sale. After that, they move to "approved" and roll toward your next payout cycle. Most programs pay monthly, on a fixed day, with a minimum balance threshold. Below that threshold, your earnings keep accumulating but no money moves until you cross the line. PayPal, bank transfer, and stablecoin are the common payout rails.

That is the whole machine. Every variation you will encounter — recurring versus one-time, lifetime cookies, refund clawback, last-click versus first-click — is a tweak to one of those four steps.

What lives in an affiliate link#

The unique URL the program gives you is not magic. It is a normal URL with one or two extra parameters that identify you. You can read them straight off the link. The four shapes you will see in the wild:

• Query parameter style: https://merchant.com/product?ref=yourname or ?aff=12345. Most common. Easy to share. Looks slightly spammy because of the ?ref= tag — many affiliates wrap these in a branded short link on their own domain so the visible URL stays clean.
• Subpath style: https://merchant.com/r/yourname. The merchant catches the path, drops the cookie, and redirects to the real product page. Same machinery, prettier URL.
• Subdomain style: https://yourname.merchant.com. Used by larger programs (Shopify Partners, ConvertKit) where the affiliate is treated as a partner with their own subdomain.
• Standalone redirect domain: https://go.partnerstack.com/aff_xxx. The merchant outsources tracking to a third-party network like PartnerStack, Impact, or Tapfiliate. The redirect domain belongs to the network, not the merchant.

The URL pattern matters because it tells you whether the program runs its own tracking or rents it from a network. Networks are usually more reliable about paying out — they hold the money in escrow and have reputational pressure from hundreds of merchants — but charge the merchant a percentage that often comes out of the affiliate's share. Self-hosted tracking is cheaper for the merchant but riskier for you if the merchant goes silent. Both work; both have failure modes.

A second-order point that matters when you start running real volume: clean, branded affiliate links convert measurably better than raw ?ref= URLs. Group chats, social platforms, and ad-blockers strip the ?ref= tag aggressively, which is the whole reason a URL shortener on a domain you own keeps affiliate commissions intact where raw network URLs leak them. Once you know which programs you are committing to long-term, set up your own tracking layer so you can add UTM parameters that match the rest of your campaign data and route through a domain your audience trusts. The merchant's affiliate ID still travels in the destination — you are just dressing the front door.

What cookies actually track, and what they don't#

The cookie is the part beginners overestimate and the part program designers underestimate. Two clarifications worth getting right.

The cookie tracks the browser, not the person. If a visitor clicks your link on their phone and buys on their laptop, they are two different cookies and you only get credited for whichever device made the purchase — and only if that device also clicked an affiliate link. Cross-device attribution is something only the largest networks attempt, and they do it badly. For solo affiliates, assume cross-device leakage of 20–40% on consumer products and lower on B2B (where buyers tend to buy on the same device they researched on).

Browser tracking-protection now blocks third-party cookies by default in Safari and Firefox, and Chrome is heading the same way. First-party cookies — set by the merchant's own domain when the visitor lands there — still work fine, which is why most modern affiliate networks switched to a redirect-and-set pattern: the click bounces through a tracker that immediately redirects to the merchant's own domain, where the cookie is set in the first-party context. If a program tells you their cookie is purely third-party, that is a red flag in 2026.

What the cookie does not know: who the person is, what they searched, what other affiliates they considered. The merchant only sees the cookie ID, the destination page, and eventually the purchase. Anything more granular — that this user spent eight minutes on the comparison page, that they came from a specific newsletter — has to come from your own tracking, layered on top with UTM parameters or a custom redirect.

Last-click, first-click, and the attribution game#

Here is where the rule choice has the biggest impact on what you actually earn. Three models exist; one dominates.

Last-click attribution. The most recent affiliate cookie wins. If a visitor clicks your link on Monday, then sees a deal-coupon site's link on Wednesday, the coupon site overwrites your cookie and gets the commission. This is the default for roughly 90% of programs and the reason coupon and deal sites cluster at the bottom of every funnel — they intercept conversions that other affiliates educated.

First-click attribution. The first affiliate cookie wins; subsequent clicks do not overwrite. Rare, but better for content creators who do top-of-funnel education. If a program offers first-click, it is signalling that it values long-form content over coupon scraping.

Multi-touch / split attribution. The commission is split across all affiliates who touched the buyer in the cookie window, weighted by recency or position. Used by very few programs because it is harder to track and harder to dispute. When it appears, it is usually in enterprise schemes.

The practical implication: if you are writing comparison or review content for a last-click program, you are competing with everyone downstream of you. Your reader can read your full review, click your link, and then a week later type the brand name into Google, click a coupon site's affiliate link for the discount, and the coupon site gets the entire commission for work you did. There is no way around this except programs that exclude coupon and deal traffic, which a small but growing number do.

Where the rules quietly cost you money#

The headline rate — "30% recurring, 90-day cookie" — is the marketing line. The fine print is where programs differentiate honest from extractive. Five clauses to look for in the T&Cs of any program before you promote it:

Refund clawback. Most programs reverse your commission if the customer refunds within thirty to ninety days. Some extend that to a year. Refund-protected programs (rare) keep your commission once it clears the hold period regardless of subsequent refunds. On products with above 5% refund rates, clawback can erase 15-20% of headline earnings.

Self-referral and family-referral bans. Standard. But "family" sometimes extends to "anyone in your household IP", which means you cannot refer your own employees or roommates. Worth checking before scaling traffic from a small office.

Payout threshold. A $50 minimum is the median. A $100+ threshold is a soft way of disenfranchising the long tail of small affiliates — money sits indefinitely until enough sales accumulate, and a non-trivial number of small affiliates abandon the program before reaching it. The fairest programs sit at $20.

Cookie reset on coupon entry. A few programs reset the affiliate cookie if the buyer enters a discount code at checkout, on the theory that the discount-code site is the "real" referrer. This functionally erases your commission on any conversion where the buyer hunted for a coupon — and most do.

Clause-change notice period. How much warning does the program give before changing the rate, the cookie window, or the payout cadence? Mature programs give 60+ days. Junior programs change retroactively. A program that quietly cut its rate mid-quarter has told you something important about how it will treat you next quarter.

The combined effect of these five clauses can cut effective earnings by 40-60% from headline. None of them are visible on the program's marketing page. All of them sit two clicks deep in the T&Cs.

The rate is what they market. The clauses are what you actually get paid. The two numbers are rarely the same.

Watch a buyer journey play out#

The interactive below walks one buyer through one journey, with rules you can change. Toggle the cookie window, attribution model, and refund clawback. The verdict at the bottom shows what you actually earn under those rules.

The default scenario — 30-day cookie, last-click, no refund — shows you earning zero on a $200 sale because the coupon site's day-28 click overwrote your cookie. Switch to first-click and you collect the full $60. Switch the cookie window to 24 hours and you earn nothing under any rule because your day-1 click had already expired by the time the purchase happened. These are the levers that turn a "30% commission" into something between $0 and $60 on the same sale.

How the merchant decides what to pay you#

The other side of the fence: when a SaaS company sets up an affiliate program, it is making a CAC-payback calculation. They are willing to pay an affiliate up to whatever leaves the customer profitable after commission. For a $30/month tool with $20 marginal margin and a 24-month average customer lifetime, the customer is worth roughly $480 in lifetime gross margin. (Where does that $20 marginal margin come from? Mostly the fact that the operating cost of a one-person SaaS is largely fixed — once the VPS, email, and Stripe fees are paid, every extra customer is close to pure margin.) The merchant can afford to pay around 30% of that — about $144 — as affiliate commission and still have a profitable channel.

How they slice that $144 between recurring rate, cookie window, and cap is a strategy decision, not a math one. A 30% recurring uncapped scheme distributes the cost over years. A $150 one-time bounty pays it all up front. The two are economically near-equivalent for the merchant; for the affiliate, the choice between recurring and one-time payouts can be the difference between a useful side income and a lottery ticket.

The cookie window is similarly strategic. A 90-day cookie costs the merchant nothing on customers who would have closed regardless and recovers them the customers they almost lost. A 24-hour cookie is the merchant saying they value coupon-site conversions over content-creator conversions. Either is a defensible business decision. Both tell you who they want as affiliates.

How payout actually works (and where it stalls)#

The payout cycle on most programs runs like this. A sale closes. Your commission moves to "pending" status — earned but not yet payable. The merchant holds it for 30 to 60 days while the refund window runs. On day 30 or 60, surviving commissions move to "approved". On the next monthly payout date — usually the 15th or the last day of the month — approved balances above the threshold are batched and sent.

Three places this stalls.

The merchant changes status manually before payout, ostensibly for review. Most programs are clean. A few use this step to dispute commissions on traffic patterns they do not like — bonus-site traffic, "incentivised" clicks, anything that looks like the affiliate paid for ads. The dispute can take weeks and is sometimes won by the merchant.

The threshold acts as a slow leak. If you are below $50 in earnings and the program has a $50 threshold, you stay there until you cross. For a small affiliate on a slow-converting product, this can mean months of "earned" income that never moves. A non-trivial number of programs structure their threshold to reduce payouts at the long tail.

The payout rail itself fails. PayPal flags an account, a bank transfer bounces, the wallet address is wrong. The program's response time on resolving these is a tell. A program that responds within a week is healthy. A program that takes a month and asks for new documentation each round is not.

The honest summary: the time from earned commission to money in your account is rarely under 60 days, often closer to 90, and occasionally never. Plan accordingly when you forecast affiliate income — a sale today is cash next quarter at the earliest.

What this looks like in practice#

If you are setting up your first affiliate stack, the honest workflow is this. Pick one or two programs whose products you genuinely use. Read all four of their rule sets — rate, cookie window, attribution, payout terms — before signing up. Set up branded short links on a domain you control so your affiliate URLs do not look like spam. Layer your own UTM parameters on top so you know which content drives which sale. Track conversions for at least sixty days before scaling time investment. The first sixty days are diagnostic — most affiliates discover that two of their four programs convert and the other two do not, regardless of how good the headline rates looked.

If you are designing your first program as a merchant, mirror it. Pay enough to attract serious content creators (20-30% recurring is the SaaS median, with a 90-day cookie). Be transparent about the rules. Pay on time. Earn the kind of reputation that gets affiliates publishing in your favour without being asked, because they trust the cheque will arrive. The programs everyone speaks well of share that one trait. The programs people warn against share the opposite.

For non-developers exploring the income side specifically, affiliate marketing is one of the more honest options on the side-hustle list — no inventory, no support burden, modest setup cost — provided you go in with realistic expectations about cookie windows, attribution, and the 60-90 day cash-flow lag. It is not a get-rich path. It is a slow compounding asset built on top of evergreen content. For a fuller view of how affiliate income stacks against direct revenue when you run a small SaaS tool, the math gets interesting at scale.

For platform-level setup — your own redirect domain, branded short links, click tracking — the short links documentation covers the practical pieces.

Frequently asked questions#