Generated banner for Attribution
Generated logo for Attribution

Attribution

Corey HainesCommunityCreated by Corey Haines

  • Skill
  • Guidelines
  • Business and productivity
  • MIT
  • No issues found

From the author

When the user wants to figure out which marketing actually drives conversions and revenue, choose or interpret an attribution model, or reconcile conflicting numbers across tools. Also use when the user mentions "attribution," "attribution model," "first-touch vs last-touch," "multi-touch," "which channel drives revenue," "what's my real CAC," "my dashboards disagree," "Google/Meta says X but GA says Y," "media mix model," "MMM," "incrementality," "geo lift," "holdout test," "how did you hear about us," "self-reported attribution," "dark social," or wants to instrument attribution themselves — "stitch my bookings to their source," "SavvyCal/Calendly attribution," "close the identify gap," "track conversions on a third-party domain," "first-party / self-hosted attribution." For event tracking setup and UTMs, see analytics. For ad-platform pixels/CAPI and conversion tracking, see conversion-tracking. For pipeline and CRM revenue reporting, see revops. For the AI-search attribution blind spot, see ai-seo.
— the description by Corey Haines

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Attribution is the process of determining which marketing efforts actually drive conversions and revenue. Because no single model is perfect, this skill helps you interpret conflicting data from various tools, choose appropriate attribution models (like first-touch, last-touch, or position-based), and implement first-party tracking to capture the full customer journey. It emphasizes that attribution is directional rather than absolute truth, helping you move beyond vanity metrics to understand the real impact of your marketing spend.

What it does

  • Reconciles conflicting conversion data across ad platforms, analytics tools, and CRMs.
  • Explains the strengths and weaknesses of various attribution models like linear, time-decay, and U-shaped.
  • Guides the setup of first-party tracking to stitch anonymous browsing to known conversions.
  • Provides frameworks for using self-reported attribution to capture dark social and word-of-mouth.
  • Helps distinguish between demand-creation channels and demand-capture channels.
  • Offers strategies for measuring incrementality and using media mix modeling for larger budgets.

When to use it

  • When you need to decide which marketing channels deserve more budget.
  • When your dashboards show conflicting numbers and you need a source of truth.
  • When you want to understand if your 'direct' traffic is actually coming from other sources.
  • When you are setting up tracking for conversions on third-party domains like booking tools.
  • When you need to explain to stakeholders why platform-reported numbers don't match your CRM.

Advantages

  • Reduces reliance on biased platform-reported data.
  • Provides a defensible, consistent methodology for reporting revenue impact.
  • Helps uncover the 'dark social' and offline touches that standard analytics miss.
  • Enables better decision-making by separating demand-gen from demand-capture.
  • Standardizes how your team talks about and measures marketing performance.

Usage examples

“My Google Ads and Meta Ads dashboards both claim the same conversion. How do I reconcile this?”
The agent will explain that you should not sum these numbers, help you pick a single source of truth (like your CRM), and guide you on how to report platform-specific credit versus real business conversions.
“We are a B2B SaaS company. Which attribution model should we use?”
The agent will recommend using a combination of first-touch and position-based models, while emphasizing the importance of self-reported attribution at the demo request stage.
“How can I track conversions that happen on a Calendly page?”
The agent will provide a guide on using metadata passthrough and webhooks to stitch the visitor's anonymous ID to the booking, ensuring the conversion is attributed to the original marketing source.
“Why does my direct traffic look so high?”
The agent will help you investigate common causes like lost referrers, dark social, or branded search, and suggest ways to validate the true source of that traffic.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/coreyhaines31/attribution/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip attribution.zip -d .agents/skills

Documentation by Corey Haines

Attribution

You help users answer the hardest question in marketing: which of my efforts actually caused this conversion and this revenue? Attribution is where marketers lose the most money — to channels that look good in one dashboard and terrible in another, to "direct" and "branded search" that hide the real source, and to models that quietly encode an opinion as if it were fact.

This skill has two pillars. Know which one the user needs before you dive in:

  • (A) Interpretation — choosing an attribution model, picking a measurement approach, and reconciling the conflicting numbers your tools report. This applies to everyone, even with zero engineering.

  • (B) Own your attribution (first-party) — instrumenting and stitching attribution yourself when you control the site/app. This is the build track. Use it when the user says "I want to track this myself" or is hitting a conversion that lives on a domain they don't own.

Most requests start with (A). Reach for (B) only when they control the surface and want to build.

Product context: check for .agents/product-marketing.md and read it if present — business type, sales cycle, and primary conversion drive almost every recommendation here.

Boundaries — what this skill does NOT own

State these up front so you don't rebuild neighboring skills:

  • General event tracking, tracking plans, UTM setup, GA4/GTM → analytics. Attribution assumes tracking exists. The line: analytics = "what events and how to fire them"; attribution = "how touches join to conversions and survive to revenue."

  • Ad-platform pixels, CAPI, server-side conversion tracking → conversion-tracking. Attribution consumes platform-reported numbers and corrects for their bias; it doesn't set up the pixels.

  • Pipeline stages, lead lifecycle, CRM revenue dashboards → revops. Attribution feeds pipeline data; it doesn't define stages.

  • Showing up in / measuring AI search → ai-seo. Attribution names AI traffic as a blind spot only.


Pillar A — Interpretation

1. What attribution can and can't tell you

Set expectations before touching a number:

  • Attribution is directional, not truth. It's a model of causality built from incomplete data (cookies expire, sessions fragment, offline touches vanish, people research on one device and buy on another). Treat it as a strong hint, never a verdict.

  • Every model is an opinion. "First-touch" says the first ad gets all the credit; "last-touch" says the closing click does. Both are wrong in opposite directions. Choosing a model is choosing whose story to believe — say so out loud.

  • The attribution gap is normal, so separate outcomes from credit. The sum of channel-reported conversions almost always exceeds real conversions, because every platform claims the same sale under its own attribution window and view-through rules. Count real conversions once, deduplicated against one source of truth, and explain platform credit separately. The two won't tie out, and a modeled allocation never replaces the conversion ledger.

When a user demands one true number, reframe: "We can get you a defensible, consistent number and a read on which channels are trending up. A single objective truth doesn't exist — here's why, and here's what we use to make decisions anyway."

2. Attribution models

The classic rule-based set plus data-driven — and when each one lies. Last non-direct is a last-touch variant (skip the junk drawer), not a separate school of thought.

ModelCredit ruleBest forHow it lies
First-touch100% to the first known touchTop-of-funnel / demand-gen valuation; short cyclesIgnores everything that closed the deal; over-credits awareness channels
Last-touch100% to the last touch before conversionDirect-response, quick e-commOver-credits bottom-funnel + branded search/direct; ignores what created demand
Last non-direct100% to last touch, skipping "direct"A cheap fix for direct pollutionStill single-touch; just moves the blind spot
LinearEqual credit to every touchLong, multi-touch journeys where every step mattersTreats a throwaway visit like a demo; flatters high-frequency channels
Time-decayMore credit to touches nearer conversionLonger cycles where recency mattersUnder-credits the top of funnel; still an assumption, not a measurement
Position-based (U-shaped)40% first, 40% last, 20% middleB2B with clear "created" + "closed" momentsThe 40/40/20 split is arbitrary; middle touches get shortchanged
Data-driven (algorithmic/Shapley)Credit from modeled marginal contributionHigh-volume accounts with enough conversionsA black box; needs volume; can't see offline/dark touches it was never fed

Platform availability note: Google Ads and GA4 retired first-click, linear, time-decay, and position-based as selectable reporting models (2023). Those UIs offer data-driven and last-click (plus GA4's paid-channels last-click variant). Teach the full table as concepts and as models you can compute on your own event path / CRM / warehouse — not as Google dropdown options.

Rules of thumb:

  • Never report a single model in isolation for a long sales cycle. Show first-touch and last-touch side by side — the truth lives between them, and the gap between them is the insight.

  • Data-driven attribution needs volume. Google Ads historically gated DDA behind ~3,000 ad interactions and ~300 conversions in 30 days; hard minimums are gone and DDA is the default, but Google still recommends ~200 conversions and ~2,000 ad interactions in 30 days for quality. Below that, DDA often collapses toward last-click priors — noise dressed as science. On Google/GA4 when thin: prefer last-click (or accept that DDA ≈ last-click). Elsewhere (first-party / CRM / warehouse): compute position-based or first+last side by side.

  • The model matters far less than being consistent and pairing it with an out-of-model sanity check (Pillar A §4, self-reported).

For the model math, worked examples of one journey scored six rule-based ways, and Shapley explained plainly, see references/attribution-models.md.

3. The three measurement paradigms

Models split credit within your tracked data. Paradigms are how you get at causality — increasingly rigorous, increasingly expensive:

ParadigmWhat it isAnswersNeedsWatch out
MTA (multi-touch attribution)Stitch user-level touches, apply a model"Which touchpoints appear on converting journeys?"Clean cross-device user-level trackingCookie loss + privacy gut user-level data; click-paths systematically over-weight search/direct and under-weight impression channels
MMM (media/marketing mix modeling)Top-down regression of spend vs. outcomes over time"What's each channel's aggregate contribution, including offline/brand?"2–3 yrs of weekly data, spend variationCorrelational; slow to react; needs real budget swings to learn
Incrementality (geo holdout, PSA, ghost ads, on/off)Controlled experiment: exposed vs. withheld"Did this channel cause lift I wouldn't have gotten anyway?"Ability to withhold; enough volume for significanceThe gold standard, but you can only test a few things at a time

How to choose: small budget / short cycle → good UTM + last-non-direct + a self-reported survey beats a fancy model. Mid budget, several channels → MTA for day-to-day + periodic incrementality tests on your biggest line items. Large budget, offline + brand spend → MMM for the portfolio + incrementality to validate MMM's coefficients. Incrementality is the tiebreaker whenever two channels both claim the same conversions.

Decision table by budget × sales cycle × channel count, and how to read a geo-holdout / PSA test (not a stats tutorial), in references/measurement-paradigms.md.

4. Self-reported attribution

The most underused signal, and often the most honest for long cycles and dark social. A post-conversion "How did you hear about us?" survey catches what tracking structurally cannot: podcasts, word of mouth, Slack communities, a founder's tweet, "a friend told me."

  • When it beats tracking: long consideration cycles, high word-of-mouth, brand/community-led, or heavy dark-social (see §5). If a big slice of your journeys are "direct," you have a self-reported-shaped hole.

  • Ask at the moment of conversion (signup, first purchase, demo request) — highest recall, before memory fades.

  • Wording: open-ended ("How did you first hear about us?") captures dark social; a short pick-list is easier to quantify but pre-biases the answer. Best practice: pick-list of your known channels plus a free-text "other/tell us more."

  • Treat it as a triangulation input, not gospel — recall is fuzzy and people credit the memorable touch, not the first. Discount survey share when turning it into credit (e.g. 22% recall of YouTube is evidence of awareness, not a claim that YouTube deserves 22% of conversions). Pair with incrementality / platform deltas before writing an allocation rule.

  • On the build side, this is a form field written to your CRM/analytics as a person property — see Pillar B and references/first-party-tracking.md.

5. Reconciling conflicting sources

The request behind most attribution work: "Google says 50, Meta says 40, GA says 60, my CRM says 35 — who's right?" Nobody is. Here's the framework.

Why each source systematically lies:

SourceBiased towardBecause
Ad platforms (Google/Meta/LinkedIn)Over-counts itselfClaims view-through + click conversions in its own window; every platform counts the same sale; motivated to look good
GA / web analyticsLast non-direct clickLoses cross-device, loses cookie-blocked users, dumps the unknown into direct
CRMWhatever the rep typed / the form capturedHuman entry, lead-source overwrites, offline deals with no digital trail
Self-reported surveyThe memorable touchRecall bias; under-counts boring-but-real touches like retargeting

How to triangulate:

  1. Pick one source of truth for the conversion count — usually your CRM or backend (the system where money is real). Everything else explains where those came from, they don't get to redefine how many.

  2. Never sum across platforms. If Google and Meta both claim a conversion, you have one conversion with two claimants, not two conversions. De-dupe against the source-of-truth total.

  3. Read directional agreement, not absolute match. If every source says paid search is up and organic is down this quarter, that trend is trustworthy even though no two numbers match.

  4. Use self-reported as the tiebreaker when platforms fight over the same conversions, and incrementality when the stakes justify a test. Do not turn a platform-vs-GA gap into a multiplier rule (Meta claims 2× GA ≠ "double Meta") — investigate windows and view-through, then ground any override in incrementality.

  5. Expect and budget for the gap. Report "platforms claim N; we can verify M; the delta is over-claiming + view-through + untracked — here's our best allocation."

  6. Operationalize triangulation as rules when you can — once you have a holdout or a trusted survey band for a channel, apply a documented channel-level override on reporting (shift credit from Direct/branded into the under-credited channel for the test window) rather than pretending raw MTA is truth. Details in references/measurement-paradigms.md.

The output is an honest allocation with confidence levels, not a false reconciliation to the decimal.

6. The blind spots

Where conversions hide, making real channels look weak:

  • Direct — the junk drawer. Bookmarks and typed URLs, yes, but also stripped referrers, app-to-web, dark social, and any touch your tracking dropped. A large direct share can include genuine direct visits, repeat users, and measurement loss. Investigate its composition before treating it as a tracking defect.

  • Branded search — people who discovered you elsewhere and Googled your name. Last-touch hands the credit to paid/organic branded search; the real driver was whatever made them search. Segment branded vs. non-branded or you'll defund the top of funnel.

  • Dark social — sharing that carries no referrer: DMs, Slack/Discord, podcasts, newsletters, screenshots. Structurally invisible to tracking; self-reported is the only way to see it (§4).

  • AI traffic — assistants and AI search increasingly influence buyers, then send them via branded search or direct, so the AI touch is invisible in analytics. Name it and hand deeper work to ai-seo.

When direct and branded search dominate, the most common explanation is a top of funnel that's working while attribution hides it. Confirm before concluding: rule out existing customers, lost referrers, and offline discovery, then check self-reported attribution or run an incrementality test. It's the most common misread in marketing in both directions, so say which one the evidence supports.

7. Business-type fork

Defaults differ sharply. Summary here; full playbooks in references/by-business-type.md.

  • B2B SaaS (long cycle, sales-assisted): journeys span weeks–months and multiple people, so single-touch models mislead badly. Anchor on the CRM as source of truth, use first-touch + position-based side by side, lean hard on self-reported at demo/signup, and treat pipeline/revenue attribution (→ revops) as the real scoreboard. Offline touches (events, sales convos) make MTA weakest and self-reported strongest here.

  • Ecommerce / DTC (short cycle, self-serve): fast journeys, high volume, spend concentrated in paid social + search. Anchor on platform ROAS but distrust it (iOS/CAPI inflation), validate with MMM once spend is material and incrementality/geo-holdouts on your biggest channels, and use a post-purchase survey to catch what pixels miss. Last-touch is defensible for quick-turn SKUs; MMM+incrementality is how you allocate the real budget.


Pillar B — Own your attribution (first-party)

Use this when the user controls the site/app and wants to instrument attribution themselves — especially for a conversion that happens on a domain they don't own (a SavvyCal/Calendly/Cal.com booking, a Stripe Checkout page). This pillar is grounded in real production builds; the full runbook with code patterns is in references/first-party-tracking.md. The essentials:

The identity graph

First-party attribution is one idea: join anonymous browsing to the eventual conversion.

  1. A visitor arrives anonymously; your analytics tool assigns an anonymous distinct_id and stamps first-touch properties ($initial_referrer, $initial_utm_*) on their events.

  2. At conversion (signup, booking, purchase) you call identify() with a stable id (email or user UUID). This merges the anonymous history into a known person — first-touch now survives all the way to the conversion.

  3. Every conversion event can now be broken down by first-touch channel. That's the whole game.

Closing the identify() gap

The most common first-party failure: nothing ever calls identify(), so conversions never join to browsing history and every customer looks like they appeared from nowhere. (Framing adapted from Tessa Kriesel's PostHog approach.) The fix is to call identify at each real conversion. Audit first — many SaaS apps already identify at signup; don't rebuild what works. Find the specific un-instrumented conversions and close only those.

Stitching conversions on a third-party domain

The one case that needs real machinery: a conversion that completes on a domain you don't control (a booking tool, a hosted checkout). You can't run your analytics there, so:

  1. At click time, a capture-phase link decorator appends the visitor's anonymous distinct_id to the outbound URL via the tool's metadata passthrough (e.g. ?metadata[ph_distinct_id]=<id>). One document-level listener covers every CTA — no per-link edits.

  2. The third-party tool stores that metadata and returns it in its webhook.

  3. Your webhook handler fires an identity merge ($identify with the booking email as distinct_id and the smuggled anonymous id as $anon_distinct_id) plus a conversion event — joining the booking back onto the marketing journey.

Guardrails (do not skip)
  • Anonymity guard — fail closed. Only ever smuggle the anonymous id. After identify(), the current id becomes the user's email/UUID; leaking that into a third-party URL or merging on it corrupts profiles (person A's email folds into whoever books). Reject ids that look like PII (contain @), cap length, and when identity is ambiguous, send nothing. If the app identifies by UUID, test distinct_id === device_id rather than an @ check.

  • First-touch data quality. Redirects overwrite the true first touch. Exclude OAuth/checkout referrers (accounts.google.com, checkout.stripe.com, login.*), your own subdomains (self-referrals), and dev hosts (localhost) from referrer classification. This is usually a settings change, not code, and it's the highest-trust-per-effort fix.

  • Cross-subdomain stitching. Marketing site → app on a subdomain must share one analytics project + a cross-subdomain cookie, or the journey breaks at the handoff. Expect near-zero numbers until the stitch is verified in prod — don't panic at empty data; use a campaign-window heuristic fallback and backfill the pre-stitch cohort in the meantime (details in the reference).

Reporting and the last mile

The first payoff is one insight: your conversion event broken down by first-touch channel ($initial_utm_source / $initial_referring_domain), and — joined to revenue — channel → conversion → revenue. Confirm first-touch vs. last-touch config in the tool (many default to last-touch; first-party attribution wants $initial_*).

But first-touch alone can't run the multi-touch models from §2. Store the full ordered touch path (not just $initial_*) and the build track feeds the interpretation track — you can score your own journeys position-based / linear / time-decay instead of only reading about them.

The last mile — get it into the CRM (production refinement from Tessa Kriesel). A breakdown in an analytics tool is a report; sales and lifecycle act on attribution written onto the record. Sync a source field with confidence and basis (journey-linked vs self-reported vs campaign-window fallback) plus a Paid-vs-Organic read off the medium, rolled up to the account (not just the contact — one B2B org is several people with mixed work/personal emails). How pipeline/lifecycle then use it is revops' job.

The pattern is tool-agnostic: identify + merge exists in PostHog, Segment, Amplitude, and via user-id in GA4; the third-party stitch works with any tool that has a metadata passthrough + webhook. PostHog + SavvyCal are the worked example in references/first-party-tracking.md.


Output format

Deliver an attribution readout, not a data dump:

# Attribution Readout — [date]

## The question
[What decision this informs — e.g. "where should next quarter's budget go?"]

## Source of truth
[Which system defines the conversion count, and why]

## What each source says
| Channel | Platform-reported | GA | CRM | Self-reported | Our read |
|---------|------------------|----|----|--------------|----------|
[De-duped against source of truth; not summed]

## Model comparison (for long cycles)
[First-touch vs last-touch side by side; the gap is the insight]

## Confidence & gaps
[The attribution gap, the blind spots, what we can't see]

## Recommendation
[Allocation call with confidence levels; the tiebreaker test worth running]

Tool Integrations

For implementation, see the tools registry. Key tools:

ToolBest ForMCPGuide
PostHogFirst-party attribution, identify/merge, funnels-posthog.md
GA4Web analytics, model comparison, user-id stitching✓ga4.md
DubShort-link + click attribution✓dub-co.md
SegmentCDP — route identify/track to every destination-segment.md
HubSpotCRM lead-source + self-reported fields✓hubspot.md
SalesforceCRM as revenue source of truth-salesforce.md
SupermetricsPull platform numbers into one place to reconcile✓supermetrics.md
RB2BDe-anonymize B2B website visitors-rb2b.md

  • analytics — event tracking, tracking plans, UTMs, GA4/GTM setup. Do this before attribution.

  • conversion-tracking — ad-platform pixels, CAPI, server-side conversion tracking, and tracking audits.

  • revops — pipeline stages, lead lifecycle, CRM revenue reporting. Attribution feeds it.

  • ai-seo — the AI-search attribution blind spot in depth.

  • ab-testing — controlled experiments; the incrementality mindset applied to on-site changes.

Files

references/first-party-tracking.md

First-Party Attribution — The Own-Your-Attribution Runbook

How to instrument and stitch attribution yourself when you control the site/app. This is the build track (Pillar B). It's distilled from real production builds and kept tool-agnostic — PostHog + SavvyCal are the worked example, but the pattern maps to any product-analytics tool with identify()/merge (Segment, Amplitude, GA4 user-id) and any third-party conversion domain with a metadata passthrough + webhook (Calendly, Cal.com, Stripe Checkout, Typeform).

The core method — closing the identify() gap so conversions join to anonymous browsing history — is adapted from Tessa Kriesel's PostHog attribution approach. Several of the production refinements that make this operate at scale are also hers, credited inline: the full-touch-path capture that feeds the model track (Step 4), the CRM last-mile with source/confidence/basis and a Paid-vs-Organic read (Step 5), the account rollup, and the "expect ~zero until the stitch is verified, with a campaign-window fallback + backfill" window (Cross-subdomain stitching). Credit where due.

The one idea

First-party attribution joins anonymous browsing to the eventual conversion:

anonymous visitor          identify() at conversion         breakdown
─────────────────          ────────────────────────         ─────────
distinct_id = anon_uuid    identify(email)                  conversion event
$initial_utm_source=...  → merges anon history        →     by $initial_utm_source
$initial_referrer=...      into person(email)               = "where do customers come from"

Everything below serves that join. If identify() never fires, every customer looks like they appeared from nowhere — that's the gap.

Step 0 — Audit before you build

The most expensive mistake is rebuilding attribution that already works. Many SaaS apps already identify() at signup and already carry first-touch on person profiles. Check the live data first:

  • Do person profiles carry $initial_utm_source / $initial_referring_domain?

  • Does a conversion event (Signed up, Converted to paid) break down cleanly by channel, or is everything "Direct"?

  • Is identity keyed by email or by an internal UUID? (This changes every guard below.)

  • Does cross-subdomain stitching work (marketing site → app.yourdomain.com)?

Only instrument the specific conversions that are genuinely un-joined. In one real audit the self-serve funnel was already solved end-to-end; the only gap was a booking on a third-party domain. Don't touch what works.

Step 1 — Identify at each real conversion

At every conversion moment, call identify() with a stable id, and set person properties:

// Normalize before use as a distinct_id — analytics tools match exact strings,
// so "[email protected]" and "[email protected]" split into two people otherwise.
export function identifyUser(email) {
  const normalized = email.trim().toLowerCase();
  window.posthog?.identify(normalized, { email: normalized });
}

With person_profiles: 'identified_only', this is the moment the person is created and their first-touch props are stamped. Fire it on form success, signup, first purchase — any moment you learn who the anonymous visitor actually is.

Step 2 — Stitch conversions on a domain you don't own

When the conversion completes on a third-party domain (a booking tool, hosted checkout), you can't run your analytics there. Smuggle the anonymous id through the tool's metadata passthrough, then merge it back in the webhook.

One document-level listener rewrites every outbound booking link at click time — no per-CTA edits, and it covers plain clicks, keyboard activation, and middle-click (auxclick):

// Refresh anonymous metadata on each SavvyCal activation; clear stale IDs.
function decorate(e) {
  const anchor = e.target?.closest?.("a[href]");
  if (!(anchor instanceof HTMLAnchorElement)) return;

  let url;
  try { url = new URL(anchor.href); } catch { return; }
  const host = url.hostname;
  if (host !== "savvycal.com" && !host.endsWith(".savvycal.com")) return;

  const distinctId = getPostHogDistinctId();   // anonymous-only — see guard
  if (distinctId) {
    url.searchParams.set("metadata[ph_distinct_id]", distinctId);
  } else {
    // The same anchor may have been decorated before identify() or reset().
    url.searchParams.delete("metadata[ph_distinct_id]");
  }
  anchor.href = url.toString();
}
document.addEventListener("click", decorate, true);    // capture phase
document.addEventListener("auxclick", decorate, true);

An early return when the guard rejects the current ID leaves any previously added metadata on the anchor. Remove that one parameter instead, preserving the booking path, other parameters and fragment. Check both click and auxclick after an identity change.

For an inline embed (e.g. /demo with an embedded calendar), pass the same id in the embed's metadata config instead; poll briefly (~2s) for the id on fresh visits, but never block the calendar from rendering.

2b — Read the anonymous id safely

The SDK stub queues calls before it loads, so get_distinct_id() returns undefined early — fall back to the tool's own cookie:

export function getPostHogDistinctId() {
  if (typeof window === "undefined") return null;

  // Prefer the loaded SDK.
  try {
    if (window.posthog?.__loaded) {
      const id = window.posthog.get_distinct_id();
      if (id) return isAnonymousDistinctId(id) ? id : null;
    }
  } catch {}

  // Fall back to PostHog's cookie before the SDK finishes loading.
  try {
    const prefix = `ph_${POSTHOG_API_KEY}_posthog=`;
    const cookie = document.cookie.split(/;\s*/).find(c => c.startsWith(prefix));
    if (!cookie) return null;
    const parsed = JSON.parse(decodeURIComponent(cookie.slice(prefix.length)));
    return typeof parsed.distinct_id === "string" && isAnonymousDistinctId(parsed.distinct_id)
      ? parsed.distinct_id : null;
  } catch { return null; }
}
2c — Merge in the webhook

The third-party tool returns your metadata in its booking.created (or checkout.completed) webhook. Fire an identity merge + a conversion event to your analytics ingestion endpoint:

// Normalize the booking email the same way the app does (Step 1), or the
// booking person will split from the app-side identity for the same user.
const userId = email.trim().toLowerCase();

const events = [];
if (anonId) {
  events.push({
    event: "$identify",
    distinct_id: userId,                                  // the known person
    properties: { $anon_distinct_id: anonId, $set: { email: userId, name } },  // merge the journey
  });
}
events.push({
  event: "discovery_call_booked",
  distinct_id: userId,
  properties: { booking_id, journey_linked: Boolean(anonId) },  // track the fallback rate
});

// Run after the booking's business-critical work; analytics must not fail it.
try {
  const response = await fetch(`${POSTHOG_HOST}/batch/`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ api_key: POSTHOG_API_KEY, batch: events }),
    signal: AbortSignal.timeout(3000),
  });
  // fetch resolves for HTTP errors too; a resolved promise isn't acceptance.
  if (!response.ok) {
    console.warn("Analytics ingestion rejected", { booking_id, status: response.status });
  }
} catch {
  // Timeouts and network errors stay non-fatal. Never log the payload or email.
  console.warn("Analytics ingestion unavailable", { booking_id });
}

When no id survives (link bypassed the decorator, e.g. a booking link inside a generated email/PDF), fall back to email-only capture with journey_linked: false. You still get the conversion; you just don't get the journey for that one.

First-touch survival caveat (PostHog specifics): the $anon_distinct_id merge carries the anonymous person's event history, but with person_profiles: 'identified_only' the anonymous visitor may never have had a person profile, so their $initial_* first-touch props aren't guaranteed to land on the merged person. Two robust fixes: call posthog.createPersonProfile() client-side before the visitor navigates off to the third-party domain (so the profile and its $initial_* exist to merge into), or capture the first-touch values client-side and pass them through the same metadata passthrough, then re-assert them in the webhook with $set_once ($set_once never overwrites an existing value, so it's safe). Without one of these, you can get the booking joined to the journey's events but a blank $initial_utm_source on the person — verify on a real booking. (posthog-js#1524.)

Step 3 — The guardrails (do not skip)

Anonymity guard — fail closed

Only ever smuggle the anonymous id. After identify(), the current distinct_id becomes the user's email/UUID — leaking that into a third-party URL, or merging on it in the webhook, folds unrelated people together and leaks PII.

Pick the guard that matches your identity model — the two are not interchangeable. The @-check below is only safe when your app identifies by email; do not copy it into a UUID-identity app.

// EMAIL-IDENTITY apps only. True only for ids safe to smuggle: reject
// email-shaped values (an identified email) and cap length.
export function isAnonymousDistinctId(id) {
  return id.length > 0 && id.length <= 100 && !id.includes("@");
}

If the app identifies by UUID, not email, the @ check is useless — an identified UUID would pass it and leak. Instead test that the current distinct_id still equals the device_id (calling identify() changes distinct_id but leaves device_id), and fail closed when device_id is unreadable:

// UUID-identity variant: only anonymous when distinct_id still == device_id.
function isAnonymous(posthog) {
  const did = posthog.get_distinct_id?.();
  const dev = posthog.get_property?.("$device_id");
  if (!did || !dev) return false;   // ambiguous → treat as identified, send nothing
  return did === dev;
}

The rule in one line: when identity is ambiguous, send nothing. A missing journey is a data gap; a wrong merge is corruption.

First-touch data quality — the cheapest big win

Redirects overwrite the true first touch, inflating "Direct"/"Referral" and hiding real acquisition. Exclude these from referrer/channel classification (usually a settings change in the analytics tool, not code):

  • OAuth / checkout redirects: accounts.google.com, login.microsoftonline.com, login.live.com, checkout.stripe.com

  • Self / subdomain referrals: yourdomain.com, app.yourdomain.com, auth.yourdomain.com

  • Dev/internal traffic: localhost, 127.0.0.1, test accounts

This is the highest-trust-per-effort fix in the whole runbook — no deploy, immediate accuracy gain. Do it first.

Cross-subdomain stitching

Marketing site → app on a subdomain must share one analytics project and a cross-subdomain cookie (PostHog's cross_subdomain_cookie default handles yourdomain.com → app.yourdomain.com). Verify the journey survives the handoff, or every signup looks like it started at the app.

Expect near-zero numbers until the stitch is verified in prod — don't panic. (Production note from Tessa Kriesel.) Before the cross-subdomain stitch is confirmed live, first-party attribution reads basically nothing — journeys break at the handoff and everything looks like direct. It flips from ~0 to real numbers the week the stitch actually ships. Two things get you through that window:

  • A campaign-window heuristic fallback. When a signup has no linked journey, attribute it to the campaign/channel that was live during its signup window — but only when date + landing page + active UTMs uniquely narrow it to one source. With overlapping campaigns, evergreen ads, email sends, branded/direct demand, or a shared landing page, the window can't isolate the cause — mark those unknown / low-confidence rather than falsely crediting whatever was live. Used narrowly, it's a real signal while the stitch stabilizes and beats a blank; used bluntly, it manufactures false attribution.

  • Backfill only the pre-stitch records that are actually missing a source. Many pre-stitch signups already have verified or self-reported attribution — never overwrite a higher-confidence source with the heuristic. Backfill only the blanks (campaign-window or self-reported), tag them as such, and keep the heuristic-backfilled history visually separate from verified trends so you don't read a cliff on launch day as a real shift.

Mark these fallback-attributed conversions with a lower-confidence basis (see Step 5) so you never confuse a heuristic guess with a verified journey.

Harden the webhook
  • Verify the provider's signature (SAVVYCAL_WEBHOOK_SECRET etc.).

  • Validate the smuggled id (string, ≤100 chars, no @) before merging.

  • Run the analytics call after any business-critical work, bounded by a timeout, non-fatal on failure. Check HTTP status and catch timeout/network rejections, as in Step 2c. If delivery needs retry guarantees, enqueue analytics separately with idempotency rather than failing or replaying the booking.

  • Log the booking id, never the email.

Step 4 — Report

  • Config check: many tools default to last-touch (PostHog's Marketing Analytics scene does). First-party attribution wants first-touch — build insights on $initial_* explicitly, or switch the default.

  • The payoff insight: conversion event broken down by $initial_utm_source / $initial_referring_domain — "where does every signup/booking come from."

  • Channel → revenue: conversion event by channel, joined to revenue/MRR person properties. Note: some tools compute revenue props at ingest (person-on-events), so historical events may read 0 — use the persons table for current MRR, or tier by plan.

  • Track your own coverage: the journey_linked: false rate tells you how many conversions bypassed the stitch. Watch it after launch.

  • Store the full touch path, not just $initial_*. (Refinement from Tessa Kriesel.) First-touch alone lets you break conversions down by first channel — but it can't run the multi-touch models from the interpretation track (SKILL.md §2: position-based, linear, time-decay). If you also persist the ordered sequence of touches per person (channel + timestamp for each, e.g. an events-table query or a touch_path array on the person), the build track feeds the interpretation track: you can now score the same journey six ways on your own data instead of only reading about the models. This is what makes Pillar A and Pillar B shake hands — capture first-touch to ship, capture the full path to model.

Step 5 — The last mile: get attribution into the CRM

(This whole step is a production refinement from Tessa Kriesel — it's the thing that turned first-party attribution from a dashboard into an operating signal.)

A channel breakdown living in your analytics tool is a report. The thing sales and lifecycle actually act on is attribution written onto the record in the CRM, per account. Sync it out:

  • A source field, plus source_confidence and source_basis. Don't write a bare channel — write the channel and how you know it. basis is the evidence type: journey_linked (verified stitch), self_reported (survey), or campaign_window (the heuristic fallback above). confidence is computed from evidence quality, not just the basis — a journey_linked touch with clean UTMs is high, the same touch with dirty/missing UTMs is lower, and a specific self-report can be high while a vague one is low. Sales treats a high-confidence source very differently from a low-confidence guess — give them both fields or they'll distrust the whole thing.

  • A Paid-vs-Organic read off the medium. The single most-used cut in practice: mark a touch paid only from explicit paid mediums (cpc, ppc, paid-social, display, paid), and classify the rest into a small, configurable taxonomy rather than a blunt "organic" — owned (email, push, SMS — though a sponsored newsletter is paid), earned (organic search/social, referral — but a partner/affiliate referral is closer to paid), direct (no medium — unknown, not organic), unknown. The fast operational question a rep or nurture flow needs is really paid vs non-paid (did this account cost acquisition dollars) — get that boundary right and keep the finer buckets configurable.

  • Roll up to the account, not just the contact (B2B) — see the account-rollup note below and in by-business-type.md.

  • Hand the record off to revops. Once the source/confidence/basis + paid/organic live on the account, how pipeline and lifecycle use them (routing, lead scoring, nurture branching, revenue attribution reporting) is the revops skill's job. This runbook's job is to get a trustworthy, labeled source onto the record.

Account rollup (B2B). One org is several people signing up with mixed work and personal emails, so person-level attribution scatters the story across records. Roll each person's source up to the account and attribute at the account level — that's where the signal has to land to be useful to a salesperson working the whole buying committee. Match on email domain, but exclude free-mail domains (gmail.com, yahoo.com, outlook.com, …) — those can't identify a company, so a domain match would collapse unrelated people into one bogus account. For personal-email signups, fall back to enrichment, your CRM's contact→account link, or manual matching.

Verification checklist

  • Click a booking CTA → URL shows metadata[<id_param>]=<anon-uuid>.

  • In console: posthog.identify('[email protected]') → click again → the param must NOT appear (guard works). posthog.reset() after.

  • Hand-POST a webhook /batch/ payload → expect {"status":"Ok"}, person appears merged.

  • Post-ship: first real webhook log shows journey_linked: true.

  • Confirm first-touch survives cross-subdomain: start on marketing site, sign up in app, check the person carries the original $initial_utm_source.

Adapting to other stacks

PiecePostHog (worked example)Generalizes to
Anonymous iddistinct_id / $device_idSegment anonymousId, Amplitude deviceId, GA4 client_id
Merge call$identify + $anon_distinct_idSegment identify (known userId, same anonymousId) + alias where needed; Amplitude setUserId on the session that still holds the anonymous deviceId (the stitch is deviceId↔userId — Amplitude's Identify API only sets user properties, it does not merge); GA4 user_id on the same client_id
Ingestion/batch/Segment HTTP API, Amplitude HTTP v2, GA4 Measurement Protocol
Third-party passthroughSavvyCal metadata[...]Calendly: only standard UTMs (utm_source/medium/campaign/content/term) plus salesforce_uuid — map the anon id into a supported UTM (e.g. utm_term), not a free-form metadata[] param. Cal.com metadata; Stripe client_reference_id/metadata
First-touch props$initial_*Segment/Amplitude first-touch, GA4 first_user_* dimensions

The shape never changes: grab the anonymous id → carry it across the boundary → merge on the far side → break the conversion down by first-touch.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Corey Haines
Publisher
Corey Haines (Community)
Source
coreyhaines31/marketingskills · skills/attribution · commit 96798cf
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Corey Haines or Corey Haines.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download attribution.zip