SpiderCPSSpiderCPS
How it works

Twelve steps,
click to settlement.

Brand sign-up to monthly payout, with the technical guts in between. Last-click attribution, 30-day cookie window (industry standard with Impact / CJ / Rakuten), idempotent server postback, real-time dashboards, monthly USD settlement.

Phase 1 — Brand onboarding

Sign up, get approved, build your first program.

01

Apply for a brand account

Sign up at spidercps.com/signup/brand with company name, contact email, niche, and a one-line pitch. We don't do automated approvals — every brand passes a human review (~1 business day) so the publisher pool stays high signal.

02

Receive API key + activation email

On approval our notification worker emails you from [email protected] with your unique brand api_key (format pc_live_<32-hex>). This key is the only thing that authenticates conversion postbacks — keep it server-side, never embed in client JS. Access it any time at /dashboard/brand/profile/.

03

Create your first program

In /dashboard/brand/programs/new/ specify the offer: dest_url (we append click_id), commission_type (flat_cpa or percentage), commission_value, cookie_window_days (30 default, up to 90), network_fee_pct (locked at 20%). Admin reviews + activates within one business day. Once active, publishers can apply.

Phase 2 — Publisher matching

AI surfaces qualified publishers; brand approves.

04

Publishers apply or are matched

Two paths into your program: self-application (publishers browse open offers at /dashboard/publisher/offers/) and AI-driven match (engine ranks publishers on six signals and surfaces a shortlist for human review at /admin/matches/). Brand approves one-click; system inserts a pc_program_publishers row with a unique tracking_slug — the publisher gets https://spidercps.com/go/<slug>.

Phase 3 — On every click

Click tracking, attribution cookie, redirect.

05

Publisher shares the tracking link

The publisher drops their unique link in their channel — WeChat group, Xiaohongshu profile, newsletter, podcast, YouTube description. Link points to our worker: https://spidercps.com/go/<slug>.

06

User clicks → Cloudflare worker redirects

Our edge worker resolves the slug, validates program + publisher, generates a click_id (UUID v4), async-inserts a pc_click_events row, and 302 redirects to the brand's dest_url with ?pcps_click=<click_id> appended. Round-trip is sub-50ms p99. Insert is non-blocking via ctx.waitUntil so even if the database is slow the redirect ships.

07

Brand landing page captures the click_id

On your landing page, read ?pcps_click from the URL and persist it through checkout — typically a 30-day first-party cookie. At checkout, read the cookie back (or pass pcps_click through hidden form fields, session storage, or your cart object — whatever survives until the order completes).

// Persist the click attribution into a 30-day first-party cookie
const cid = new URLSearchParams(location.search).get("pcps_click");
if (cid) {
  document.cookie = `pcps_click=${cid}; path=/; max-age=2592000; samesite=lax`;
}
Phase 4 — On every conversion

Server postback, attribution, commission split.

08

User completes the purchase

Whatever your conversion event is — order placed, lead form submitted, signup completed — record it in your own system. Capture the pcps_click cookie value alongside the order so it survives to step 09.

09

Brand server posts to /api/conv

From your backend (server-side only — never browser), POST a JSON payload with program_id, brand_order_ref, order_value, order_currency, and pcps_click, authenticated with your Bearer API key. See the curl and Node.js samples on the page.

curl -X POST https://spidercps.com/api/conv \
  -H "Authorization: Bearer pc_live_<your-32-hex-key>" \
  -H "Content-Type: application/json" \
  -d '{
    "program_id":      "uuid-of-program-from-dashboard",
    "brand_order_ref": "ORDER-2026-0001",
    "order_value":     99.00,
    "order_currency":  "USD",
    "pcps_click":      "uuid-from-cookie"
  }'
await fetch("https://spidercps.com/api/conv", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.SPIDERCPS_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    program_id:      PROGRAM_ID,
    brand_order_ref: order.id,
    order_value:     order.subtotal_usd,
    order_currency:  "USD",
    pcps_click:      order.metadata.pcps_click,
  }),
});
10

SpiderCPS attributes + calculates commission

Our worker validates the API key, looks up the latest matching pc_click_events row within the cookie window, attributes the credit to the publisher (or marks unattributed), calculates commission (flat_cpa or percentage), takes the 20% network fee, and runs idempotency check on (program_id, brand_order_ref). Returns JSON with conversion id, status, attributed publisher, commission breakdown.

Phase 5 — Real-time + settlement

Dashboards update instantly; payouts ship monthly.

11

Conversion appears in real-time dashboards

Supabase Realtime streams the new conversion to the brand dashboard (/dashboard/brand/conversions/), publisher dashboard (/dashboard/publisher/earnings/ — only their credited conversions), and admin review queue (/admin/conversions/). Postgres row-level security enforces tenant isolation — a brand can never see another brand's data.

12

Monthly settlement

On the 1st of each month, approved conversions from the prior month roll into publisher payouts (aggregated per publisher, paid by their chosen method on the 15th) and brand invoices (PDF, gross commission + 20% network fee, Net 30 USD wire or ACH to Fullhouse Asset Management LLC). Payouts are gated on brand invoice status — if the brand hasn't paid, we hold the publisher payout until collected. No publisher ever takes the credit risk.

Attribution rules

The rules of the game.

Last-click wins within cookie window
If a user clicks publisher A's link day 1, then publisher B's day 3, then converts day 5 → publisher B gets credit (30-day default; brand-configurable up to 90 per program).
Unattributed conversions still recorded
If the postback arrives without a matching cookie (user cleared cookies / ad-blocker stripped the URL param / outside cookie window), the conversion is inserted with publisher_id=null. Network fee still applies; no publisher payout.
Idempotent deduplication
A brand can never double-charge via the same (program_id, brand_order_ref) pair. The second postback returns status: 'duplicate' without inserting. Safe to retry on network errors.
Reversals for refunds + fraud
Brand or admin can reverse a conversion within 30 days of insert (refunds, chargebacks, suspected fraud). Reversed conversions don't pay out — if a payout already shipped, the next cycle nets out.
Abuse guards on /api/conv
Rate limit 60 conversions / 60s per program; order_value ceiling $100k; commission ceiling $5k. Hits trigger 429 / 400 with retry-after. Designed to protect the network from leaked-API-key abuse.

Ready to see it run on your numbers?

15-min discovery call → 1-page MSA → program live in 3–7 days. We model unit economics on your existing CPS spend before any paperwork.