How we track the results of a UGC film

Three levels. Start with the one you have the appetite for.

Level 0, no technology at all

We create a discount code per creator. You report the sales in your dashboard once a month. It works from day one, and it works even when the click happens inside Instagram's browser, where link parameters are often lost. The downside is stated plainly for the creator: the number is labelled Reported because we have not been able to check it.

Level 1, a webhook from your checkout

You send us a signed line every time an order is paid. The number then becomes Verified, and that is the level we recommend: it is not analytics, it is the basis for invoicing. The description is further down.

When you post the film yourselves

That is the normal case, and everything above still applies. But the click path changes owner: if the creator posts, our link sits in her bio; if you post, there is no such place. The link then has to sit with you, and there are three places it can sit, best first:

1. The ad's destination. If you run the film as an ad on Meta or TikTok, you set the destination yourselves. Paste the tracking link there and every click is measured. That actually gives cleaner numbers than a link in a bio.
2. Your own link sticker or "link in bio" during the campaign.
3. Only the discount code. Works even when nobody clicked anything, for example when someone sees the film and looks you up themselves.

If you do not want to send traffic through us

Fair objection, and it has an answer. Keep your own address and add ?ugc=<code>. Then read the parameter out in the checkout and send it as code in the webhook, and the sale is attributed exactly as usual. On Shopify this happens automatically, we read the landing page out of the order.

The price is the clicks: they never pass through us and cannot be measured. Choose The company's own link when you create the tracking link, and the creator's page shows "Not measured" for clicks instead of a zero. That is not a detail. A zero next to five orders looks like an error, and then it is your campaign that looks broken.

One thing that costs you nothing

If you run the film as a partnership ad on Meta or a spark ad on TikTok, from the creator's own handle, she gets access to some of the ad figures directly. That solves half the visibility question without you having to connect any account.

Level 2, you connect your accounts

Instagram, TikTok and Meta Ads let us in if you give us read access to your own accounts. Only then can views on your posts be shown as From the platform. Without that connection there is no legal or technical way for us to read statistics on a post that sits with you, and anyone who claims otherwise is selling you guesses.

What you need to do

1. Register the company and pick a creator on a brief.
2. Create a tracking link under Results. Set where the visitor goes and what commission applies.
3. Set up a discount code with the same name in your shop. It catches the purchases where nobody clicked the link.
4. Connect your checkout as described below.

The webhook

Send POST to your own address:

https://ugcguiden.se/api/konvertering/<your-name>

The body is JSON. Only four fields are needed:

{
  "order_id":   "1001",
  "amount":     "499.50",
  "currency":   "SEK",
  "code":       "anna-host",
  "occurred_at": "2026-08-21T10:04:00Z"
}

code is the tracking link code, the discount code or the value you read out of ?ugc= on the landing page. All three work. Send "status": "refund" on the same order_id on a return, and the commission is clawed back.

The signature

Compute HMAC-SHA256 over the raw body using the signing key from your results page, and send it in the header X-UGC-Signature. Hex or base64, both are accepted.

const body = JSON.stringify(order);
const sig = crypto.createHmac("sha256", SIGNING_KEY).update(body).digest("hex");

await fetch("https://ugcguiden.se/api/konvertering/your-name", {
  method: "POST",
  headers: { "content-type": "application/json", "X-UGC-Signature": sig },
  body,
});

Sign exactly the string you send. If you re-serialise the object after computing the signature it no longer matches, and that is the only error we see in practice.

Shopify

Point a webhook for Order payment at the address above. No code needed: we recognise Shopify's own X-Shopify-Hmac-Sha256 and read the discount code out of the order. Put your app secret on the results page so we can verify it.

The responses

• ok the order is recorded
• ingen-kod the order carried no creator code, we stored nothing
• okand-kod the code is not yours
• utanfor-fonster the code has passed its end date
• avslutad-lank the collaboration has ended
• HTTP 401 the signature does not match

The two middle ones mean no commission is due and nothing was stored. Returns always go through, even after the end date: otherwise you could avoid repaying commission by waiting it out.

We answer 200 even on ingen-kod. That is deliberate: a 4xx puts the order in your retry queue and it keeps coming back indefinitely.

What we store, and what we do not

Only orders carrying a creator code reach us. Every other order is discarded the second we have read the body. We store order number, amount, currency and time. We do not store customer names, addresses, emails or line items, even when they are in the body you send.

On the click side we store no IP address. The visitor becomes a hash of IP, browser and today's date, which lets us tell a unique visitor from a reload within a day but not follow anyone over time.

What we cannot do

We cannot see views on a post that sits on your account until you connect the account. We do not see purchases in a physical shop, or purchases where neither link nor code was used.

One more thing, and it matters to use the right words for it. We measure which orders carried the creator's code, and that is what commission is calculated on. We do not measure whether the same customer would have bought anyway. That answer is not in any order feed, ours or any affiliate network's: it takes a test where part of the audience does not see the film, and the difference between the groups is the effect.

The distinction is worth keeping straight on your side too. "The film generated 200,000 kronor" is a claim someone can dispute. "200,000 kronor in orders carried the creator's code" is a fact, and it is what you are invoiced on.

Register a company See the jobs