Affiliate and Referral Program Stinger
Practitioner arsenal for affiliate-referral-program-wasp-drone. Encodes the domain knowledge to select, configure, instrument, and economically validate affiliate and referral programs for SaaS products in 2026.
When to use this stinger
The Angel reads this SKILL.md first for every invocation. Then navigates to the specific guide for the task. Common triggers:
- Platform selection: "Which affiliate platform should I use?"
- Attribution design: "Our Safari users aren't being attributed."
- Fraud configuration: "How do we prevent self-referral fraud?"
- Payout design: "Should we do 20% recurring or a flat fee?"
- Economics modeling: "Will this program pay back at 30% commission?"
Platform tiers (2026 snapshot)
SMB / bootstrapped tier (< $5K/month affiliate revenue)
| Platform | Monthly base | Transaction fee | Stripe | Fraud | Best for |
|---|---|---|---|---|---|
| Rewardful | $49+ | Up to 9% (revenue-cap plans) | Yes | Mid | Stripe-native SaaS, simplest setup |
| FirstPromoter | $99+ | 0% | Yes + Paddle, Recurly, Braintree | Strongest | Scale past $5K/mo affiliate revenue; 5 billing integrations |
| Tolt | $47+* | 2.9% + $0.30/conversion* | Stripe + Paddle | Weakest | Needs embeddable widget on custom domain |
*Tolt pricing has changed repeatedly. Always verify current pricing page before recommending.
Break-even rule: FirstPromoter ($99/mo, 0% fees) becomes cheaper than Rewardful (9% fees) when monthly affiliate-tracked revenue exceeds ~$5,000. Model this before recommending.
See guides/01-platform-selection.md for the full decision matrix including mid-market and enterprise tiers (PartnerStack, Impact, Tapfiliate).
Attribution in 2026 (the ITP problem)
The single most important context for any new program:
- Safari ITP caps JavaScript-set first-party cookies at 7 days (24 hours if the URL contains tracking parameters like
utm_source,gclid,fbclid). - Firefox ETP blocks third-party cookies by default since v103.
- Chrome reversed third-party cookie deprecation (April 2025); 3PC remain on by default in Chrome as of 2026. Safari is the irreversible problem.
- Combined impact: 30-35% of global web traffic already operates without functional cookie-based attribution.
The only escape: set affiliate tracking cookies via HTTP Set-Cookie response headers from your own server (not via JavaScript). Server-set cookies respect the full configured duration (up to ~400 days). S2S postback is the architecturally sound primary attribution path.
See guides/02-attribution-architecture.md for implementation patterns.
Fraud controls (minimum viable set)
Before any commission runs, wire:
- Self-referral detection (IP match + /24 subnet check)
- Conversion rate anomaly monitoring (flag if outside 2 std dev of program average)
- Velocity alerts (flag at 3-5x daily click baseline)
- Click-to-conversion time distribution (flag clustering at 0 seconds OR at exact cookie-window boundary)
- Disposable email domain block list
See guides/04-fraud-detection.md for detection thresholds and per-platform native controls.
Economics benchmarks (2026, Rewardful dataset)
| Metric | Industry benchmark |
|---|---|
| Average commission rate | 24.16% (range: 20-30%) |
| Affiliate activation rate | 7.6% generate a referral; 1.28% generate a sale |
| Referral-to-sale conversion | 0.8% average; 2-5% for strong programs |
| Average payout per commission | $14.10 |
| Program durability | Only 15.6% survive long-term |
| Strong EPC benchmark | $1.50-$3.00 range |
See guides/05-economics-model.md for the full break-even formula and EPC/LTV model.
Critical directives (from Command Brief)
- Always distinguish affiliate from referral before recommending a platform. Different economics, fraud profiles, and participant incentives; conflating them causes expensive platform mismatches.
- Never recommend cookie-only attribution without disclosing ITP / Firefox ETP risk. 30-35% of traffic is already affected.
- Flag self-referral and velocity fraud controls as mandatory. Programs without minimum controls are abused within days.
- Always model EPC and LTV payback before finalising a commission rate. A competitive-looking rate can be economically destructive if LTV is low.
- Do not configure Stripe payout automation without verifying US 1099/W-9 obligations and EU GDPR data obligations. Tax liability risk is real.
Folder layout
textaffiliate-referral-program-stinger/ +- SKILL.md (this file — master index) +- README.md (one-page overview) +- guides/ | +- 00-principles.md (taxonomy, three levers, five evaluation criteria) | +- 01-platform-selection.md (decision matrix: SMB to enterprise) | +- 02-attribution-architecture.md (cookie-based vs first-party vs S2S postback) | +- 03-payout-design.md (commission structures, hold periods, payout mechanics) | +- 04-fraud-detection.md (detection thresholds, platform controls, supplemental layers) | +- 05-economics-model.md (EPC, LTV payback, break-even formula, benchmarks) +- examples/ | +- bootstrapped-saas-rewardful-setup.md (happy path: sub-$10K MRR, Rewardful, Stripe) | +- enterprise-partnerstack-checklist.md (Series B+ scenario, PartnerStack, S2S attribution) +- templates/ | +- program-config-spec.md (per-engagement structured capture template) +- reports/ | +- README.md (report format and past-run accumulation notes) +- research/ (owned by scripture-historian — do not modify) +- research-plan.md +- research-summary.md +- index.md +- external/ (12 source notes)
