ProBackend
TikTok Ad Attribution & Tracking
TikTok ad attribution module with ATT permission flow, standard/custom event tracking, and debug logging — bridges to TikTok Business SDK via closure injection. Includes complete integration guide with credentials setup, App Store compliance, and campaign launch workflow (iOS only)
Pro
Included in ShipSwift Pro: $89 a year, or $199 for life.
Copies a short instruction with your private download link. Paste it into your agent: it downloads the whole skill (the source code, the setup steps and the mistakes we already made for you) and builds the screen.
Works with
+70
What it does
Platform: iOS only — this module uses AppTrackingTransparency and device-level ad attribution APIs not available on macOS.
Using RevenueCat for IAP? Read this skill for the client-SDK fundamentals, then switch to the companion TikTok Ad Attribution with RevenueCat — it changes the purchase-tracking hook (RC purchase callback instead of StoreKit), adds the device-identifier relay (collectDeviceIdentifiers), and ships a server-side forwarder that reports renewals/refunds to TikTok Events API (true LTV, which client-only tracking can never see). This skill as-is is the complete solution for native StoreKit 2 apps.Most iOS apps running paid ads need event tracking for attribution — knowing which ad brought each user and what they did afterward. This requires:
- Requesting ATT (App Tracking Transparency) permission at the right time
- Bridging to a tracking SDK (TikTok, Facebook, etc.) for event delivery
- Firing standard events (Purchase, Subscribe, ViewContent) and custom events
- Debugging which events were sent during development
This module provides a reusable, SDK-agnostic tracking layer. You inject your actual SDK calls via a closure, so the module works with TikTok Business SDK, Facebook SDK, or any other attribution provider — without coupling your app code to a specific vendor.
Permission timing strategy: this module uses the deferred request + retry pattern — ATT authorization is requested after the network permission dialog has been dismissed, with a 0.5s delay and retry support, complying with App Store rules. For an overview of all three permission patterns (use-site / onboarding prefetch / deferred), see Permission Prefetch Pattern.
What you get
- ✓598 lines of source code, ready to paste
- ✓Architecture
- ✓Dependencies
- ✓Implementation
- ✓Integration Checklist
- ✓Known Pitfalls
- ✓App Store Submission Checklist
- ✓Verification & Campaign Launch
tiktoktrackingATTattributionad eventsAppTrackingTransparency
More in Backend
- AWS Infrastructure with CDKFreeProduction-ready AWS infrastructure using CDK — App Runner for HTTP services, Aurora Serverless for database, Cognito for auth, Lambda for serverless functions, and S3 for storage
- Supabase Row Level Security (RLS) Data IsolationFreeProduction-ready Row Level Security patterns for a Supabase + Cloudflare Workers stack — the database-layer isolation primitive that makes cross-user data leaks impossible even when a route is buggy or someone talks to PostgREST directly. Covers the owner-isolation table skeleton (1:1 profile + one-to-many children), the five load-bearing RLS rules ((select auth.uid()) wrapping, TO authenticated, forward-set child subqueries, indexing policy columns, trusting only auth.uid()/app_metadata), the service_role (bypass RLS) vs user-JWT (RLS enforced) client split, server-side owner_id injection, public read-only tables whose writes funnel through service_role, and a two-token cross-access isolation test that must return 403/empty.
- Supabase Storage Private Buckets + Signed URLsFreeProduction-ready private file storage for a Supabase + Cloudflare Workers stack — a private bucket created as an idempotent SQL migration, server-side service_role uploads (the client never talks to Storage and never holds the service key), and on-demand signed URLs with short TTLs. IDOR-proof by construction — the object path is derived from the verified JWT ({userId}/{itemId}.jpg, never client-supplied) and ownership is checked through RLS before any URL is signed — with defense-in-depth RLS policies on storage.objects, orphan-object cleanup (Postgres ON DELETE CASCADE never touches Storage), and the pitfalls of public buckets and leaked signed URLs.
- Supabase + Cloudflare Workers InfrastructureFreeProduction-ready serverless infrastructure using Supabase (managed Postgres + Auth + Storage) and Cloudflare Workers (Hono backend) — the zero-VPC, zero-server counterpart to the AWS CDK stack. Covers Supabase CLI migrations, the immutable-region rule, secret management (.dev.vars / Cloudflare Secret, never git), Workers deployment via wrangler, and dual-mode JWT verification (JWKS ES256 preferred, HS256 fallback).
- TikTok Ad Attribution with RevenueCat (Dual-Channel)ProFull-depth TikTok attribution for RevenueCat apps — client SDK reports the purchase moment, your backend forwards renewals/refunds from RC webhooks to TikTok Events API. Ships the complete Workers forwarder, device-identifier relay chain (ATT → RC → webhook → Events API), ASN wiring, and a battle-tested verification SOP (iOS + Cloudflare Workers)