Attribution

AppRefer tells you which ad, campaign and network brought each install, and uses that to report trials and revenue back to the network.

Coming from a general mobile measurement partner? See how AppRefer compares with AppsFlyer, including what AppRefer doesn't do (deep linking, fraud protection).

How it works

Call configure() when the app starts. On the first launch the SDK sends one request with the install's signals; AppRefer matches it to the ad click that drove it and returns the result. Later launches return the cached result without waiting on the network.

import AppRefer

let attribution = await AppRefer.configure(apiKey: "pk_live_...")
print(attribution?.network ?? "unknown")

If you need to tell an organic install from a failed request, use configureResult() (SDK 0.9.0+). It returns one of attributed (with the attribution), pending (the install is waiting for the user's tracking answer, see below), organic or failed. An Apple Ads match counts as attributed even while the tracking answer is pending.

What you get back

Matching order

AppRefer tries each method in turn and stops at the first match. The deterministic methods come first; probabilistic matching is the last resort before organic.

Methods 2 to 6 need tracking permission (see below). Each click can be claimed by only one install.

Tracking consent

AppRefer never shows the App Tracking Transparency prompt. From SDK 0.6.0 the iOS SDK reads the status your app already has and sends it with the install: granted, denied (also restricted) or undetermined (not asked yet). On Android you pass your own consent with setTrackingConsent().

• Granted: full matching, conversions are sent to ad networks and advanced matching is kept.
• Denied: first-party only. The install gets Apple AdServices or organic, nothing is sent to ad networks, and no advertising ID or hashed personal data is stored.
• Undetermined: the decision is held. The install starts first-party and is not counted in reports yet. When the user answers, the SDK reports it: granted runs the full match once, denied keeps the first-party result. Purchases made in the meantime are queued for about 6.5 hours, so a purchase made just before the user taps Allow is still sent. With no answer after 24 hours the install is finalised as first-party.
• Not sent (older SDKs, or Android apps that never call setTrackingConsent()): behaves as before consent existed, unless the app requires consent (see settings below).

AppRefer re-reads the stored consent on every forward, including retries and webhook purchases, so a later change in iOS Settings is honoured. The SDK checks again on every configure() and each time the app becomes active. Call trackingConsentDidChange() right after your own prompt so the answer is sent straight away.

import AppTrackingTransparency

_ = await ATTrackingManager.requestTrackingAuthorization()
await AppRefer.trackingConsentDidChange()

Two hosts

Requests from installs that allowed tracking go to trk.apprefer.com. Everything else (installs that denied or haven't answered, and all Support traffic) goes to apprefer.com. AppRefer Billing picks its host the same way. The SDK never falls back from one to the other, so in your iOS privacy manifest you declare only trk.apprefer.com under NSPrivacyTrackingDomains.

App settings that change matching

Two per-app switches, set with PATCH /api/v1/apps/{appId} using an organisation API key with apps:write:

curl -X PATCH https://apprefer.com/api/v1/apps/APP_ID \
  -H "Authorization: Bearer ak_live_..." \
  -H "Content-Type: application/json" \
  -d '{"probabilisticMatching": false, "trackingConsentRequired": true}'

Country

Each install gets a country for reporting. AppRefer uses the matched click's country or Apple Ads' country first, then the country the hosting edge reports for the request, and finally the region in the device locale (for example en_GB gives GB). The locale is an approximation, used only when nothing better exists.

Improve ad network match rates

After sign-up or login, call setAdvancedMatching() with the user's email or phone. Values are SHA-256 hashed on the device and attached to conversions for installs that allowed tracking. The call does nothing for installs that didn't. Code for each SDK is on the Events page.