All specs
growthmedium complexity

Referrals & Invites

Grow via referral rewards and team invites: reward models, attribution, invite flows, funnel tracking, and abuse controls.

Options

Reward Model*

Referrer (and optionally referee) earns credit redeemable against subscription or usage.
Cash rewards (PayPal, Stripe Connect, Tremendous) once a threshold is met.
Referrals unlock a premium feature, seat, storage bump, or trial extension.
Track referrals for attribution but offer no direct incentive.

Attribution Mechanism*

Unique per-user referral code embedded in the link (yoursite.com/?ref=abc123); captured at signup.
Drop a cookie on landing that survives across sessions until the user signs up or it expires.
Attribution captured when the referee enters a referral code at signup or their email matches a sent invite.

Invite Flows Supported*

Admin invites a user to an existing workspace with a pre-assigned role.
Each user gets a unique code they can share; successful signups are attributed to them.
Admin uploads a list of emails (optionally with role/team columns) and the system sends invites.
Admin UI to resend pending invites, regenerate expired tokens, and revoke before acceptance.

Abuse & Fraud Controls

Signals that block obvious fraud: same IP, same device fingerprint, disposable email domains, credit-card match on payout.
Maximum total reward per referrer (monthly, annual, lifetime); cap per referee on bilateral rewards.
Pending invites and unclaimed referral links expire after N days (typically 14–30).
Admins can revoke pending invites and clawback rewards on confirmed fraud; all actions logged.

Decision Points

Referral reward: credit, cash, or feature unlock?

If yes

Default to account credit for SaaS — it avoids payout operations, tax forms, and cash-attractive fraud. Use cash only when your product has no meaningful in-product currency.

If no

If no reward at all, verify your product is inherently shareable — referrals without incentives need product-led virality to move.

Both sides rewarded or only the referrer?

If yes

Bilateral rewards lift share conversion noticeably (the referrer can say "you get $10 too"). Per-referral cost doubles — budget accordingly and cap aggressively.

If no

Referrer-only is cheaper and simpler to explain, but expect lower share-to-signup conversion rates.

Per-user referral codes or shared campaign codes?

If yes

Per-user codes — required for attribution and individual reward tracking. Each user gets a unique signed token tied to their account.

If no

Shared campaign codes (PROMO2026) are for marketing campaigns, not referrals — use both together, not interchangeably.

Cap rewards per referrer to prevent abuse?

If yes

Set a monthly and lifetime cap per user. Most legitimate referrers send 1–3; a cap of 20 protects the budget without hurting real growth.

If no

Uncapped rewards are only defensible for very low-value rewards (free trial extension) where fraud has minimal upside.

Attribution via cookie, link token, or account-link?

If yes

Use signed link tokens as the primary mechanism (most reliable), with first-party cookies as a fallback for delayed conversions. Account linking covers invite-based flows.

If no

Relying on only one mechanism will leak 20–40% of conversions. Combine at least link tokens + cookies.

Fraud detection for self-referrals / burner accounts?

If yes

Mandatory if rewards have cash value. Block same-IP, same-device-fingerprint, and disposable-email-domain pairs. Flag for review rather than auto-denying to avoid false positives.

If no

Acceptable only when rewards have no extractable value (e.g. feature unlocks that require an active paid account).

Public leaderboard for top referrers?

If yes

Drives competition among power users but also concentrates fraud incentive. Gate by minimum verified referrals and hide cash amounts.

If no

Private dashboards are enough for most products — leaderboards are a marketing feature, not a growth requirement.

Team invites separate from consumer referrals?

If yes

Yes — they are different features with different flows. Team invites are admin-initiated with pre-assigned roles; referrals are user-initiated with public codes. Share the invite token infrastructure but keep UX separate.

If no

Merging them confuses admins and creates permissions ambiguity ("did this invite give them owner access?").

Pre-assign role/team when inviting?

If yes

Encode the role and team in the invite token itself — signed so the invitee cannot escalate. Lets you onboard new hires with correct scope from first login.

If no

Invitees land in the workspace with a default role and require admin cleanup — acceptable only for small teams.

Expire pending invites after N days?

If yes

Default to 14–30 days. Prevents stale tokens from granting access months later, which is both a security and hygiene issue.

If no

Non-expiring invites are never the right default — even trusted SaaS uses TTLs.

Allow resending or regenerating invites?

If yes

Both. Resend keeps the same token for accidentally-deleted emails; regenerate invalidates the old one for cases where the original may have been compromised.

If no

You will create a support ticket for every invite that hits a spam filter. Build it.

Bulk invite via CSV?

If yes

Required for enterprise. Accept email plus optional role/team columns, validate on upload, show a preview with duplicate detection, and send async with a completion email.

If no

Single-invite flow is fine for self-serve SaaS under ~20 seats per workspace.

Track invite funnel (sent → opened → signed up → activated)?

If yes

Instrument all four stages as events. Without this, you cannot tell whether your problem is sharing, landing-page conversion, or onboarding activation.

If no

Aggregate conversion-only metrics hide the real failure point and make reward/share-copy iteration blind.

Tenant-customizable invite email branding?

If yes

Logo, sender name, and a short custom blurb at minimum. Enterprise customers consistently push back on generic-branded invites landing in their employees' inboxes.

If no

Default branding is fine for self-serve and SMB — whitelabel can be an enterprise-tier feature.

Revoke pending invites from admin UI?

If yes

Essential. The moment an admin realizes they invited the wrong person (or someone who left the company mid-process), they need an immediate kill switch.

If no

Waiting for expiration is not acceptable — security teams will reject this.

Tradeoffs

ComplexityCash rewards offered

Fraud attack surface expands dramatically — requires KYC, velocity checks, and operational review workflows

CostBilateral rewards (both sides paid)

Higher conversion per share, but per-referral cost doubles and self-referral fraud becomes more attractive

UXCookie-based attribution only

Meaningful attribution loss on privacy-focused browsers and app-to-web flows

UXFunnel tracking end-to-end

Clear visibility into where referrals drop off — essential for optimizing the reward, share copy, and landing page

Dependencies

user-system

Implementation Examples

ReferralCandy

Hosted referral program for e-commerce — reward rules, fraud checks, payouts, and Shopify integration.

PartnerStack

B2B SaaS partner and affiliate platform with tiers, payout rails, and agency support.

Rewardful

Stripe-native affiliate/referral tracking for SaaS — attribution, commissions, and double-sided rewards.

Viral Loops

Template-driven viral and referral campaigns — leaderboards, milestones, and waitlists.

Friendbuy

Referral and advocacy platform focused on attribution, reward rules, and funnel analytics.