Discovery
The canonical location is https://example.org/.well-known/affiliate.txt. Hosting the file on the advertiser's domain verifies the source and keeps it independent of any single CPA network.
The server should return UTF-8 text with status 200. A short redirect to the canonical domain is acceptable.
Format
The draft uses simple key: value lines and named sections in square brackets. Comments start with #.
version: 0.1 program: Example Store website: https://example.org contact: [email protected] updated: 2026-09-17 [offer default] status: active landing: https://example.org allowed: content forbidden: cookie-stuffing
Field order is irrelevant. Unknown fields must be ignored so the format can evolve without breaking older integrations.
Core fields
| Field | Required | Purpose |
|---|---|---|
version | Yes | Syntax version used to parse the file. |
program | Yes | Public affiliate program name. |
website | Yes | Advertiser's canonical domain. |
contact | Yes | Operational program contact. |
updated | Yes | Date of the latest material change in ISO format. |
policy | No | Full legal program terms. |
disputes | No | Appeal contact or procedure URL. |
Offers
Each offer is a separate [offer identifier] section. The identifier remains stable through ordinary term updates.
| Field | Example | Meaning |
|---|---|---|
status | active / paused / closed | Whether new traffic may be sent. |
landing | URL | Primary landing page. |
payout | 7% confirmed order | Short public payout description. |
cookie | 30d | Attribution window. |
allowed | content, cashback | Allowed promotion types. |
forbidden | brand-bidding | Explicitly prohibited methods. |
assets | URL | Current creative, feeds or API docs. |
Changes and disputes
A critical change — a new restriction, attribution rule, payout or status — requires a new updated date. Previous versions should be retained and linked through changelog.
A violation record is meaningful only with the source rule, file version, event time and appeal process. The standard does not determine guilt.
Data safety
Do not publish personal phone numbers, private keys, tokens, private rates, client lists or any information not intended for public access.
This is a first format hypothesis, not a final specification. Field names and syntax will change after real-world testing.