Turn your customers into a sales team.

import crypto from 'node:crypto';

// Called by your backend when an order is paid.
export async function reportSale(order, attribution) {
  const body = JSON.stringify({
    programId: 'prog_…',
    externalOrderId: order.id,      // retries are safe
    amountCents: order.totalCents,
    currency: 'USD',
    clickIds: attribution.clickIds, // from window.ccos
    couponCode: order.couponCode,
  });

  const t = Math.floor(Date.now() / 1000);
  const hash = crypto.createHash('sha256').update(body).digest('hex');
  const v1 = crypto.createHmac('sha256', process.env.CCOS_SECRET)
    .update(`v1\n${t}\nPOST\n/track/conversion\n${hash}`)
    .digest('hex');

  return fetch(`${API}/track/conversion`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-CCOS-Signature': `t=${t},v1=${v1}`,
    },
    body,
  });
}

import hashlib, hmac, json, os, time, requests

SECRET = os.environ["CCOS_SECRET"].encode()

def report_sale(order, attribution):
    body = json.dumps({
        "programId": "prog_…",
        "externalOrderId": order["id"],   # retries are safe
        "amountCents": order["total_cents"],
        "currency": "USD",
        "clickIds": attribution["clickIds"],
    }, separators=(",", ":"))
    t = str(int(time.time()))
    digest = hashlib.sha256(body.encode()).hexdigest()
    signed = "\n".join(["v1", t, "POST", "/track/conversion", digest])
    v1 = hmac.new(SECRET, signed.encode(), hashlib.sha256).hexdigest()
    return requests.post(API + "/track/conversion", data=body,
        headers={"Content-Type": "application/json",
                 "X-CCOS-Signature": f"t={t},v1={v1}"})

# No server code? Most platforms can call a URL after a sale.
GET /track/postback
  ?programId=prog_…
  &orderId={order_id}
  &amountCents={total_cents}
  &currency=USD
  &clickId={click_id}
  &t={unix_time}
  &sig={hmac}

# sig = HMAC-SHA256(secret, "v1\n{t}\nGET\n/track/postback\n" + sha256(query))