
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
affitor-node
Advanced tools
Affitor server-side SDK — typed trackLead()/trackSale() over the Affitor conversion API (Bearer). Provider-agnostic.
Affitor server-side SDK — typed trackLead() / trackSale() over the Affitor
conversion API. Provider-agnostic: works with Stripe, Polar, Lemon Squeezy, Paddle,
or any payment processor.
npm i affitor-node
import { Affitor } from 'affitor-node';
const affitor = new Affitor({ apiKey: process.env.AFFITOR_API_KEY! });
// At signup — binds the customer to the affiliate click:
await affitor.trackLead({ customerExternalId: user.id, clickId });
// At purchase (e.g. inside your Polar / Lemon Squeezy / Stripe webhook handler):
await affitor.trackSale({
customerExternalId: user.id, // resolves attribution — no clickId needed once bound
amount: 4999, // integer cents
invoiceId: order.id, // idempotency key
saleType: 'subscription',
isRecurring: true,
subscriptionInterval: 'monthly',
});
Attribution model (Dub-style): bind the customer at lead time
(customerExternalId ↔ clickId), then a sale only needs customerExternalId.
No need to thread the click id through a Merchant-of-Record checkout.
Server-side only — the program API key is a secret; never ship it to a browser.
For browser click/lead capture use affitor-sdk.
| Method | Endpoint | Auth |
|---|---|---|
trackLead({ customerExternalId, clickId, email? }) | POST /api/v1/track/lead | Bearer |
trackSale({ customerExternalId, amount, invoiceId, currency?, saleType?, isRecurring?, subscriptionId?, subscriptionInterval? }) | POST /api/v1/track/sale | Bearer |
trackClick({ affiliateUrl?, ... }) | POST /api/v1/track/click | public |
Methods resolve to { ok, status, data, error } (they don't reject on HTTP/network
errors). Programmer errors (missing apiKey, invalid amount/invoiceId) throw.
Options: new Affitor({ apiKey, apiUrl?, fetch? }) — apiUrl defaults to
https://api.affitor.com; pass fetch for Node < 18 or testing.
FAQs
Affitor server-side SDK — typed trackLead()/trackSale() over the Affitor conversion API (Bearer). Provider-agnostic.
We found that affitor-node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.