# How revenue attribution works

> Where revenue comes from, how a payment is matched back to the visitor who made it, and what happens when it cannot be.

Section: Revenue attribution  
Canonical page: https://statsy.co/docs/revenue  
Last updated: 2026-09-15

Most analytics tools stop at the visit. Statsy carries on to the payment: your provider tells Statsy that money arrived, Statsy works out which visitor it was, and credits the sources that brought them. The result is revenue, customers and refunds sitting next to visitors in every breakdown.

## Revenue comes from two places only

1. **Signed payment webhooks** from [Stripe](https://statsy.co/docs/revenue/stripe), [Lemon Squeezy](https://statsy.co/docs/revenue/lemon-squeezy), [Paddle](https://statsy.co/docs/revenue/paddle), [Polar](https://statsy.co/docs/revenue/polar) and [Razorpay](https://statsy.co/docs/revenue/razorpay). Every request is checked against the signing secret before anything is stored.
2. **The [Payment API](https://statsy.co/docs/revenue/payment-api)**, authenticated with a token, for payments from anywhere else. The **Revenue** page uses it to [record a payment by hand](https://statsy.co/docs/revenue/manual-payments).

> **Watch out.** Amounts sent from a browser are never counted, because a browser can be made to say anything. The old `statsy.revenue()` call still works, but it only records a `purchase` conversion; its amount is ignored.

## Matching a payment to a visitor

When a payment arrives, Statsy tries three things in order:

1. **The visitor id carried through checkout.** When somebody clicks a hosted checkout link, the script adds their id to it, so the provider hands it straight back — as Stripe's `client_reference_id`, or as `statsy_vid` in metadata, custom data or notes.
2. **An email you linked with `statsy.identify()`.** The oldest claim on an email wins, and a claim made more than five minutes after the payment is ignored, so a forged identify call cannot steal credit for somebody else's sale.
3. **A customer already on file**, matched by customer id or email.

A payment that matches none of them still counts toward total revenue, and still counts as its own customer. It simply does not appear in the by-channel report, because there is no visit to credit.

## Touches

Every visit that carries a source — a referrer, UTM tags, an ad click id — is stored as a **touch** for that visitor, with its channel, referrer host, campaign, landing page and time. The attribution report splits each payment across the touches that came before it. How it splits is up to you: see [Attribution models and lookback](https://statsy.co/docs/revenue/attribution-models).

## What gets recorded

- One-time payments, subscription renewals and refunds. Refunds are stored as negative amounts and reduce net revenue.
- Subscription cancellations, which mark the customer as churned rather than changing any money.
- Each payment once. A payment is unique per provider payment id, so a provider retrying a webhook ten times still produces one row.
- The original currency, plus a USD figure converted at the day's reference rate, so mixed-currency businesses can be totalled.

## What it cannot do

Crediting a payment to a channel needs a persistent visitor id, which exists in Full mode only. Payments from cookieless visitors count toward revenue but usually cannot be credited unless they match by email or customer id. Ad blockers and consent choices reduce what can be measured at all. Attribution numbers are a good estimate, not an audit.

Nothing appearing? Work through [Payments not showing up](https://statsy.co/docs/revenue/troubleshooting).

Previous: [Install on Docusaurus](https://statsy.co/docs/install/docusaurus)  
Next: [Stripe](https://statsy.co/docs/revenue/stripe)