Affiliate tracking sounds complicated, but the mechanism is simple. A partner shares a link that points at your product through a redirect. That redirect records the click and carries a token into your app, both as a URL parameter and a first-party cookie.
Your app stores that token on the user record at signup. This is the step most integrations get wrong: if the token is not persisted, later payments have nothing to attribute. Capture it on the landing page, thread it through OAuth, and write it to the user once they register.
When the user pays, your backend reports the sale with the stored token. Attribution resolves by token first, then by your user id, then by email. The commission is calculated against the campaign rule and returned in the same response, so you can apply any customer reward immediately.
Webhooks are optional. The reward comes back synchronously on the sale call, so you only add a receiver if you want async lifecycle events like payout confirmations or refund clawbacks.