In-depth dismantling of ChatGPT ad tracking SDK: 30-day attribution window + Fernet quadruple encryption, impact on Affiliate content entrepreneurs

Security researcher buchodi fully exposed the technical architecture of the ChatGPT advertising system: 30-day product browsing attribution tracking, 4-layer Fernet encrypted click tokens, and contextual accurate delivery are achieved through OAIQ SDK. This article explains the practical significance of this system to AI tool affiliate entrepreneurs from the perspective of content monetization.

Core conclusion

The ChatGPT advertising system is no longer just a proof of concept. On April 28, security researcher buchodi released the most detailed technical breakdown of the ChatGPT advertising attribution chain on the Internet, confirming that OpenAI has deployed a complete advertising technology stack: SSE stream injection advertising, OAIQ client SDK tracking, 30-day cookie attribution window, and 4-layer Fernet encryption to prevent fraud.

Advertisers currently online include Grubhub, GetYourGuide, Canva, Aritzia, etc., and delivery is matched in real time based on conversation context. For content creators who make money with the AI tool Affiliate, this means three key changes:

A new monetization path appears — if your content is referenced by ChatGPT, you can serve as an advertiser and place contextual ads
The attribution window is up to 30 days — any purchase within 30 days of a user clicking on the ad will be counted as your conversion
High technical barriers - OpenAI uses AES-128-CBC + HMAC-SHA256 quadruple encryption to prevent tampering, which significantly increases the cost of advertising fraud.

Key Points

Time of incident: 2026-04-28 (technical details exposed) -Affected objects: AI tool Affiliate content creators, automated monetization practitioners
Core changes: ChatGPT advertising has entered the substantive operation stage from Beta, and the complete tracking chain has been deployed

Background and trigger events

On April 28, security researcher buchodi published an in-depth technical article "How ChatGPT serves ads. Here's the full attribution loop." on his blog Buchodi's Threat Intel. The article received 495 points and 352 comments on Hacker News in one day, becoming one of the hottest AI topics of the day.

The article captures the complete communication between both ends of the ChatGPT advertising system - the front-end SSE ad injection and the back-end OAIQ tracking SDK - through a fleet of user-authorized mobile traffic research devices. This is the first time since OpenAI established an internal advertising department at the end of 2025 that an external researcher has completely restored the entire advertising and attribution chain.

Previously, there have been cases proving that using the ChatGPT advertising platform with n8n automated content distribution can achieve a monthly income model of US$5,200. This technology exposure provides creators interested in entering this field with the opportunity to understand this system from a technical level.

Key Impact (by Dimension)

Dimensions	Change	What it means to us	Recommended actions
Monetization path	OpenAI officially launches the advertising platform, traffic can be converted into revenue	AI chat interface becomes a trackable advertising channel for the first time	Learn the advertiser entry process and evaluate whether your products are suitable for placement in ChatGPT
Attribution window	OAIQ SDK sets a cookie with a 30-day (720 hours) TTL	There is an attribution window of up to 1 month from user click to actual conversion	Optimize the landing page to the conversion funnel and make full use of the 30-day window to lengthen the investment cycle
Anti-cheating	4-layer Fernet encryption, AES-128-CBC + HMAC-SHA256	The cost of false advertising traffic increases, and the value of high-quality content increases	Investing in content quality rather than brushing methods, the real ROI increases due to a low fraud environment
Accuracy	Contextual real-time matching, different topics correspond to different advertisers	Accuracy is much higher than traditional pan-investment advertising	Vertical depth content has more advertising monetization value than pan-traffic SEO
Product categories	The first batch of advertisers focus on travel, food delivery, and design tools	High-price decision-making products are the first to benefit	Give priority to building content in these tracks and wait for OpenAI to expand advertising categories

Technical architecture interpretation: OAIQ SDK and attribution chain

How ads appear in conversations

When you send a message to ChatGPT, the backend mixes in a specific type of advertising event in the SSE stream chatgpt.com/backend-api/f/conversation. These events are of type single_advertiser_ad_unit, and the naming implies that there may be multiple advertiser variations later.

Ad units contain:

advertiser_brand — Advertiser information, stable account identifier with adacct_ prefix
carousel_cards — carousel cards
target.open_externally: false — Open WebView embedded in ChatGPT to facilitate OpenAI to observe page jumps

Four-layer encryption token

Each ad comes with 4 Fernet encrypted blobs (AES-128-CBC + HMAC-SHA256):

ads_spam_integrity_payload — SSE data is transferred internally, and the server prevents forged clicks
oppref — Appears on click URL, copied to browser cookie by OAIQ SDK, TTL 720 hours (30 days) — This is a forward attribution token
olref — Paired with oppref, suspected to be server-side logging
ad_data_token — base64-encoded cross-domain tracking token

This means that after you click an ad from ChatGPT, all product views and purchases on that advertiser's website within 30 days will be attributed to the ChatGPT ad source.

1. Study the advertiser onboarding process

Currently, ChatGPT advertisers are registered through OpenAI Ads Manager (adacct_ prefix account system). If your product is an AI tool such as n8n, Claude Code, OpenClaw, etc., evaluate whether it is suitable for advertising on ChatGPT.

2. Content strategy adjustment

Ad placement is based on conversation context matching. The more vertical the content and the more focused the topic, the higher the probability of being included in ChatGPT and displaying relevant ads in relevant conversations. There is a need to shift from covering all keywords to doing in-depth research on specific topics.

3. Automation tool upgrade

With the automated content collection and publishing workflow built by n8n + OpenAI, your content can be included in ChatGPT faster.

4. Track attribution data

The 30-day cookie window means you need to evaluate performance against longer-term data. It is recommended to set special tracking parameters and configure UTM parameters on the landing page to observe the traffic source.

Related extended information

Tool entry

The AI services and tools covered in this article are: OpenAI, ChatGPT, n8n, Claude Code, OpenClaw

Internal link guidance

Real case: Someone has used ChatGPT advertising platform + n8n to automate content distribution, earning US$5,200 per month: I use ChatGPT advertising platform + n8n to automate content distribution and earn a real review of $5,200 per month
Want to learn how? Watch: How to build an AI content automated distribution system with n8n + ChatGPT: a complete 30-minute tutorial
Newbies should read first: AI Agent Tools 2026 Complete Tutorial: 5 Tools to Build an Automated Pipeline in 30 Minutes