Count one landing on a referral link. Unauthenticated, 204 (spec 1.1).

<br/>The marketing site fires this once per page load that carries a valid<br/>?ref=, with keepalive: true and nobody reading the response, so the<br/>route answers 204 to everything it is handed: an unknown code, a code<br/>whose affiliate is still pending, a body that is not JSON, a visitor who<br/>already counted today. Every one of those is the same silence, because an<br/>endpoint that answered them differently would be a free oracle for<br/>"which referral codes exist" to anyone with a script.<br/><br/>The body is parsed here instead of being declared as a body: parameter:<br/>the framework answers an unparseable body with its own 422, and this<br/>route promises 204. ClickBeaconRequest still owns the shape.<br/><br/>The ONE refusal a caller can see is 429. A rate limit has to be visible<br/>or a client cannot back off, and the limit is per ip, so saying it out<br/>loud reveals nothing about any affiliate. The limiter fails open: an<br/>unreachable Redis lets the click through rather than blocking the site.<br/><br/>The identity of the caller is request.remote_addr and nothing a client<br/>can write. See clicks.client_ip: with X-Forwarded-For read directly,<br/>anyone could mint a fresh visitor per request and both the dedup and the<br/>rate limit would be decoration.