Web

See what visitors from each creator, campaign and link do on your website (the pages they view, the steps of your funnel and where they drop off) and credit the orders they place. The results are in the dashboard under Web campaigns, and under Users and Events with the Web switch.

The web SDK, @ondropp/dropplink-web, has two halves:

Money never comes from the browser. The web key is public by design, so Dropplink treats what the script sends as behaviour only; orders come from your server. See SDK, server and web keys.

Set it up#

1. Add your website to the app

   In Settings → Project details → Edit, turn on Website and add your website's domains, one per line: for example yourbrand.com and www.yourbrand.com. Add every host your visitors use; the script only works on these. Saving creates the app's web key, shown in Project details and in Settings → SDK keys.

   A project can be website-only: turn off Android and iOS, and set a web fallback (where its links go).

2. Add the script to every page

   Put this in the <head> of every page. It's served from your own link domain, so it's first-party on your site and ad blockers don't block it. SDK setup → Website shows it with your link domain and key filled in.

   <script src="https://go.yourbrand.com/_d/s.js" data-key="pk_3f9c1e2a7b6d4c80" async></script>

   Visits, page views (single-page apps included) and time on page are recorded from here on. To call dropplink before the script has loaded, add this stub first; the calls run as soon as it loads:

   <script>
     window.dropplink = window.dropplink || { q: [] };
     ["track", "identify", "logout", "grant", "revoke"].forEach(function (m) {
       dropplink[m] = dropplink[m] || function () { dropplink.q.push([m].concat([].slice.call(arguments))); };
     });
   </script>

   With a bundler, use npm instead:

   npm install @ondropp/dropplink-web

   import { init } from "@ondropp/dropplink-web";
    
   // init() starts the script once and returns the same client on every call.
   // During server rendering it returns a client that does nothing.
   export const dropplink = () => init({ key: "pk_3f9c1e2a7b6d4c80", endpoint: "https://go.yourbrand.com/_d/e" });

   "use client";
   import { useEffect } from "react";
   import { dropplink } from "@/lib/dropplink";
    
   export function DropplinkInit() {
     useEffect(() => void dropplink(), []);
     return null;
   }

   Then dropplink().track("add_to_cart") anywhere in the browser.

   Option	Script tag	Default
   key	data-key	required	The app's web key
   consent	data-consent="required"	"granted"	Wait for dropplink.grant() (see Consent)
   spa	data-spa="false"	true	Count route changes in single-page apps as page views
   cookieDomain	data-cookie-domain=".yourbrand.com"	this host	Keep one visitor across subdomains
   debug	data-debug="true"	false	Log each batch to the console. Never ship it on.

3. Track your funnel

   The Web campaigns funnel is built from these names. page_view is automatic:

   Event	When
   view_item	A product page
   add_to_cart	Added to cart
   begin_checkout	Checkout started
   sign_up	An account created
   purchase	Use your server's order (next step), so revenue can be trusted

   dropplink.track("view_item", { sku: "RS-9" });
   dropplink.track("add_to_cart", { sku: "RS-9", price: 1499 });
   dropplink.track("begin_checkout");
    
   dropplink.identify("user_8812"); // after sign-in: your own ID, never an email or phone
   dropplink.logout();

   Names are snake_case. Up to 20 properties, with string, number, boolean or null values; anything that looks like an email or a phone number is dropped in the browser. identify links the visitor to your user in their journey only: it's unverified, so it never moves credit. An order from your server with the same visitor verifies it.

4. Send orders from your server

   Keep the visitor's ID with the order (the dropp_vid cookie, or dropplink.getVisitorId() at checkout) and send it when the payment is confirmed, with your server key:

   import { DropplinkServer, readVisitorId } from "@ondropp/dropplink-web/server";
    
   const dropplink = new DropplinkServer({ serverKey: process.env.DROPPLINK_SERVER_KEY });
    
   // When the order is created:
   order.droppVisitorId = readVisitorId(req.headers.cookie);
    
   // In your payment webhook:
   await dropplink.track({
     eventId: `order-${order.id}`,   // your own ID: a webhook that fires twice counts once
     visitorId: order.droppVisitorId,
     userId: order.customerId,       // optional, see below
     name: "purchase",
     ts: order.paidAt,               // a Date, or unix seconds
     revenue: { amount: order.total, currency: order.currency, orderId: order.id },
   });

   curl -X POST https://attribution.ondropp.app/v1/s2s/events \
     -H "Authorization: Bearer $DROPPLINK_SERVER_KEY" \
     -H "Content-Type: application/json" \
     -d '{ "events": [{ "eventId": "order-W5521", "visitorId": "0b6e5c1a-3f2d-4c8e-9a71-5d4b2e6f8c10", "name": "purchase",
           "ts": '"$(date +%s)"', "revenue": { "amount": 1499, "currency": "INR", "orderId": "W5521" } }] }'

   track takes one order or a list, batches large lists, and retries rate limits and server errors; resending is always safe. Refunds are a negative amount with the refunded order's orderId.

5. Check it works

   Open one of your links on a computer and browse your site for a minute. Within a few minutes the visit shows in Web campaigns (credited to that link) and under Users → Web. With data-debug="true", the console logs [Dropplink] sent 3: 3 stored.

Which creator gets the credit#

Each visitor's first touch is the first Dropplink link they arrived from in the last 30 days. It never changes: a later link names only that visit's source.

• Visits, pages and funnel events count for the visitor's first-touch creator, campaign and link. Visitors who never came from a Dropplink link are other traffic, split by where they came from: search, social, AI assistants, email, other campaigns (UTM), other websites, or direct.
• An order sent with the visitorId goes to that first touch, unless the customer is already credited to a creator through your app (first touch wins there too).
• With a userId, that click also becomes the customer's first touch, so their later orders are credited by userId alone, on any device and with no cookie.

Consent#

With data-consent="required", the script keeps only the Dropplink click (it holds nothing about the person and is needed to credit an order) until you call dropplink.grant(). Events tracked before that wait in memory and are sent on grant(). dropplink.revoke() clears everything stored and stops sending.

Cookies, both first-party: dropp_vid (the visitor ID, 13 months) and dropp_click_id (the first click, 30 days). Nothing else about the visitor is stored in the browser. Device and country come from the request; IP addresses are never stored.

Without the script#

If you can't add the script, links still send website visitors to your site with ?dropp_click_id=c_…. Save it in a cookie, store it on the order, and send it as clickId instead of visitorId. You get credited orders, but not visits, pages or the funnel. See the Server API.

Limits#

• Raw visits and page views are kept 90 days, daily totals for 12 months. Visitor counts, the funnel and pages need a range inside the last 90 days.
• Safari keeps script storage for 7 days, so a returning Safari visitor may count as new after a week. Send userId with orders: once a customer is credited, their credit no longer depends on the browser.
• Crawlers and automated browsers aren't counted.