Introduction

A referral program in a mobile app is not just a share button with a promo code attached. To work well on both Android and iPhone, you need a backend that issues referral identities, a linking strategy that survives app install, and fraud checks so rewards are granted once and only when the qualifying event really happened.

Design the Referral Flow First

Before writing SDK code, decide what counts as a successful referral. Common choices include:

• New user installs and creates an account
• New user completes first purchase
• New user reaches a milestone inside the app

The backend should own this rule. If the mobile app decides reward eligibility on its own, users can spoof requests or trigger duplicate rewards.

A practical flow looks like this:

1. Existing user requests a referral link
2. Backend creates a token tied to that user
3. User shares the link
4. New user opens the link, installs the app if needed, and signs up
5. App sends the captured token to the backend
6. Backend verifies the token, checks eligibility, and awards both sides if the rules are met

Keep Attribution on the Server

The server should generate short-lived or signed referral tokens. That gives you auditability and lets you invalidate abused links.

Example backend endpoint in TypeScript:

1import crypto from "node:crypto";
2import express from "express";
3
4const app = express();
5app.use(express.json());
6
7app.post("/referrals/create", (req, res) => {
8  const userId = req.body.userId;
9  const token = crypto.randomBytes(16).toString("hex");
10
11  // Persist token, inviter, created time, and status in a database.
12  const url = `https://example.app/invite?ref=${token}`;
13  res.json({ token, url });
14});
15
16app.post("/referrals/redeem", (req, res) => {
17  const { refToken, newUserId, eventType } = req.body;
18
19  // Look up the token, reject self-referrals, and ensure idempotency.
20  // Reward only after the qualifying event has been confirmed.
21  res.json({ accepted: true });
22});

Notice what is missing: reward logic in the client. The client only collects and forwards attribution data.

Handle Links on Both Platforms

For cross-platform referral, the safest design is a single web URL that can route to:

• Android App Links when the app is installed
• iOS Universal Links when the app is installed
• A landing page or store page when it is not installed

On Android, extract the token from the launch Intent:

1class InviteActivity : AppCompatActivity() {
2    override fun onCreate(savedInstanceState: Bundle?) {
3        super.onCreate(savedInstanceState)
4
5        val refToken = intent?.data?.getQueryParameter("ref")
6        if (refToken != null) {
7            getSharedPreferences("referral", MODE_PRIVATE)
8                .edit()
9                .putString("pending_referral", refToken)
10                .apply()
11        }
12    }
13}

On iPhone, do the same when handling a universal link:

1func scene(_ scene: UIScene, continue userActivity: NSUserActivity) {
2    guard userActivity.activityType == NSUserActivityTypeBrowsingWeb,
3          let url = userActivity.webpageURL,
4          let components = URLComponents(url: url, resolvingAgainstBaseURL: false),
5          let ref = components.queryItems?.first(where: { $0.name == "ref" })?.value
6    else { return }
7
8    UserDefaults.standard.set(ref, forKey: "pending_referral")
9}

Store the token locally until signup or purchase is complete, then send it to the backend once the user has a real account identity.

Reward Only After a Trustworthy Event

A common mistake is rewarding on install alone. That is easy to abuse with emulators, reinstall loops, and disposable accounts. A stronger pattern is:

• Capture referral token at open time
• Attach it to account creation
• Mark it pending
• Finalize the reward only after a server-verified event such as first payment or first completed order

This pattern also helps with delayed attribution. A user may click a link today, install tomorrow, and register later.

Add Fraud Controls Early

Referral systems attract abuse quickly. Build in checks from the start:

• Prevent inviter and invitee from sharing the same account, device fingerprint, or payment method
• Make redemption idempotent
• Set one reward per invitee
• Expire stale tokens
• Log every reward decision for review

Without those controls, the growth feature becomes a payout bug.

Common Pitfalls

• Letting the app grant rewards directly instead of sending claims to the server.
• Rewarding on installs rather than on a meaningful server-verified milestone.
• Forgetting post-install attribution, which causes many legitimate referrals to disappear.
• Using platform-specific referral formats instead of one shared link model across Android and iPhone.

Summary

• Build the referral program around a backend-owned token and reward workflow.
• Use one web link that can route into Android App Links and iOS Universal Links.
• Capture the referral token on the device, but validate and redeem it on the server.
• Reward only after a verified event such as signup completion or first purchase.
• Add fraud checks and idempotency before launch, not after abuse starts.