Cookieless traffic and revenue attribution: which ad brought paying users

The problem

A study app ran its first paid social ad with UTM tags on every link. A few days later nobody could say whether a single buyer had come from it.

The checkout knew nothing about the source, campaign or landing page. The analytics tool knew the user and their onboarding answer to "How did you hear about us?", but never saw the UTMs. The hosting provider's analytics saw the URLs, kept its UTM report behind a paid add-on, and could not join a visit to a later purchase. The onboarding answer was self-reported: in one example week, 1 person in 40 answered "an ad" while the ad brought 60 visitors.

The usual fix, a cookie tool or an ad pixel, comes with a consent banner. On an app for students, a banner on the landing page costs signups. The team wanted every signup and order attributed to its first visit, nothing stored on the device, and a site with no banner.

The solution

The browser keeps the visit in memory. @vevee/sdk/browser reads the landing URL once and holds a random visit id, the UTM tags, the referrer host and the landing path in a JavaScript variable. No cookie, no storage. A reload or a new tab starts a new visit, unless the app carries it through the URL with toParam and fromParam.

The browser never talks to Vevee. It posts to the app's own route, which re-validates the visit, adds the visitor's coarse location and device from the host's headers, and calls Vevee with the secret key (hybrid mode).

At signup the server calls identify with isSignup: true and the visit as firstTouch. Vevee stores it on the person once and derives a channel from it. Orders and refunds come from the payment webhook through vevee.revenue and are credited to that first touch.

Anonymous events count visits; identified events count people. Vevee never links one to the other, and the source is the only thing that crosses at signup.

Example

The signup route stores the first touch on the new person and sends an anonymous twin of the signup that closes the visit funnel. Nothing joins the two events.

import { createClient, contextFromHeaders, type FirstTouch } from "@vevee/sdk";

const vevee = createClient({ apiKey: process.env.VEVEE_SECRET_KEY! });

export async function onSignup(req: Request, userId: string, visit: (FirstTouch & { visit_id?: string }) | null) {
  const context = contextFromHeaders(req.headers);
  const { visit_id, ...firstTouch } = visit ?? {};

  // Identified half: the person keeps their first touch, without the visit id.
  await vevee.analytics.identify(userId, { plan: "free" }, undefined, {
    isSignup: true,
    ...(visit ? { firstTouch } : {}),
    context, // only country and device class are kept at signup
  });

  // Anonymous half: closes the visit funnel. No distinctId.
  if (visit_id) {
    await vevee.analytics.capture({
      event: "signup_completed",
      properties: { visit_id, ...firstTouch },
      context,
    });
  }
}

// Later, in the payment webhook:
export async function onOrderPaid(order: { id: string; userId: string; netAmount: number; currency: string }) {
  await vevee.revenue
    .order({
      distinctId: order.userId,
      orderId: order.id,         // idempotent on the provider's id
      amount: order.netAmount,   // minor units, after discounts, before tax
      currency: order.currency,
      billingReason: "subscription_create",
    })
    .catch((err) => console.error("[vevee] revenue.order", err)); // never fail the webhook
}

Let your coding agent do it

Paste this into Claude Code, Cursor or another coding agent from your app's repository.

Add Vevee cookieless traffic attribution to this app. Use only the official docs below as the source of truth: fetch them before writing code, and follow them over anything you remember.

Read first (whole SDK reference plus the docs in one file):
https://www.vevee.org/llms-full.txt

Then the pages for this feature:
- Step by step guide: https://www.vevee.org/docs/guides/traffic-attribution
- Browser helper (@vevee/sdk/browser): https://www.vevee.org/docs/methods/browser-attribution
- identify at signup (isSignup, firstTouch, context): https://www.vevee.org/docs/methods/identify
- capture with context: https://www.vevee.org/docs/methods/capture
- Revenue from the payment webhook: https://www.vevee.org/docs/methods/revenue
- How channels are assigned: https://www.vevee.org/docs/concepts/channels
- Funnel splits and the JSON import: https://www.vevee.org/docs/guides/funnel-splits
- Next.js walkthrough: https://www.vevee.org/guides/cookieless-attribution-nextjs
- Webhook walkthrough: https://www.vevee.org/guides/revenue-from-payment-webhook
- Testing with fake traffic: https://www.vevee.org/guides/test-attribution-fake-traffic

Requirements:
- Install @vevee/sdk@^1.14.0. The browser uses only @vevee/sdk/browser (no API key there). The secret key stays on the server.
- Hybrid mode: the browser posts to our own API route, which forwards to Vevee with contextFromHeaders(req.headers). Never send or store the IP.
- No cookies, localStorage or sessionStorage for attribution: the visit lives in memory only.
- At signup: identify with isSignup: true and firstTouch from attribution.current().
- Send revenue.order / revenue.refund from the existing payment webhook. Amounts are integer minor units; the order id is the idempotency key.
- Ad links must use a paid utm_medium (for example utm_medium=paid_social), or the visit counts as social, not paid.
- If this app is not Next.js, apply the same pattern with its own routing and server.
- Test everything with an sk_test_ key before going live.

Before coding, read the codebase and give me a short plan: which files you will add or change, and where our signup and payment webhook live. Wait for my OK, then implement.

Frequently asked questions

Other use cases