When customers sign up to your referral program — whether through the Join Page link, an embedded signup widget on your store, or the floating referral widget — they all land in the same advocate-facing experience afterwards: a Share Page with their referral link, and a private Your Rewards tab where they track rewards and manage their account.
This article walks through what advocates see and what they can do at each step, regardless of which signup surface brought them in.
How the post-signup flow works
Every advocate goes through the same three-stage path after signing up:
Signup — through whichever signup surface you've set up (Join Page link, Join block on Shopify, Embedded signup on Other Platforms, or the Floating Referral Widget on either).
Share Page — the public, advocate-facing page where they see their referral link and one-click share buttons. No authentication required to see this.
Your Rewards tab — the private, auth-gated tab on the Share Page where advocates track their rewards, customize their referral link, and update their PayPal payout email (if you use cash rewards).
After signup, every advocate lands in the same ReferralCandy-hosted post-signup experience — the Share Page at <your-subdomain>.referralcandy.com/share/<advocate-code> and the Rewards page at <your-subdomain>.referralcandy.com/rewards/<advocate-code>. This is the same on Shopify and Other Platforms. The signup surface itself varies — the Join Page is also RC-hosted, but Join block and Embedded signup live on your storefront.
The Share Page (Invite Friends tab) — public
Right after signing up, the advocate lands on their Share Page at a URL like <your-subdomain>.referralcandy.com/share/<advocate-code>. The Invite Friends tab is the default view; this is the public surface, accessible to anyone with the URL.
What the advocate sees on this tab:
Their personal referral link — the URL they share with friends. By default it ends in an auto-generated advocate code (like
/u/PWHW4ZK); they can customize this on the Your Rewards tab (see below).One-click share buttons for the social/messaging channels you've enabled — Email, WhatsApp, Facebook Messenger, Twitter/X, Telegram, Threads, etc. Each button opens the appropriate sharing flow with the referral link and a message preview prepopulated.
A tier preview (if you use FlexiTiers) showing what rewards they unlock as they refer more friends.
A "How it works" summary so they understand the basic referral flow.
No authentication required. Anyone who knows the advocate's email (and types it on the Join Page) can land on their Share Page, see the referral link, and use the share buttons. The public surface is designed for easy sharing without friction.
The Your Rewards tab — auth-gated
At the top of the Share Page, there's a second tab labeled Your Rewards. Clicking it triggers an authentication screen because the Rewards content is private — it includes things like the advocate's PayPal email, their custom referral link slug, and their detailed rewards history.
How advocates authenticate
Advocates have two ways to sign in to their Your Rewards tab:
Email me a sign-in link — no password needed. ReferralCandy emails them a temporary one-click sign-in link. They click it from their inbox and are automatically signed in. No password to remember. Works the same way for first-time access and return visits.
Set / enter a password. The first time they access Your Rewards, they create a password (at least 8 characters) and confirm it. On subsequent visits they enter the password to log in (with a Forgot Password link as recovery).
Both options are shown on the same authentication screen — the password fields as the primary input, plus an "Email me a sign-in link" button below an "OR" divider with the label "No password needed".
Recommendation: For most advocates, the Email me a sign-in link option is the more practical default. Advocates typically don't visit their Rewards tab often enough to memorize a password, so the sign-in link is a lower-friction path — they just need access to the email they signed up with.
What advocates can do on the Rewards page
Once authenticated, the Rewards content lets the advocate:
Track the status of earned rewards. See which rewards have been delivered, are pending, under review, expired, paid, or unable to deliver — depending on your campaign's reward type and where each reward is in your fulfillment flow.
Customize their referral link slug. Replace the auto-generated advocate code (e.g.,
/u/PWHW4ZK) with a memorable vanity slug (e.g.,/u/adamcool). This makes the referral link easier to share verbally or in print. The first time an advocate visits the Rewards page, a "Customize invite link" popup auto-opens to nudge them to set a vanity slug. They can close it and reopen it later via the Change link button near the bottom of the page.Heads up: Changing the vanity slug breaks the previously-shared link. The old link will stop working — referred friends who click it land on your store URL instead of the friend offer. Advocates should pick a slug they're happy keeping long-term.
Update their PayPal payout email (if your campaign pays out cash rewards via PayPal). By default, ReferralCandy uses the email the advocate signed up with as their PayPal payout email — works for most advocates whose signup email matches their PayPal account. The Add PayPal email card on the Rewards page only appears after the advocate has earned their first issued cash reward — not while a referred purchase is still in review period, and not for non-cash reward types (custom rewards or coupon rewards). Until then, the card is hidden. If their PayPal account uses a different email, they can update it from the card so cash payouts go to the right place.
Returning advocates
An already-enrolled advocate who clicks your Join Page link, signup widget, or floating widget — and enters the email they originally signed up with — is recognized and taken straight to their Share Page (Invite Friends tab) with no signup flow and no authentication. They can grab their referral link and share again.
Authentication only kicks in if they click the Your Rewards tab. So the typical advocate who just wants to share their link again doesn't hit any auth gate.
Customizing the Share Page and Rewards page design
All the pages in the advocate's post-signup journey are customizable in your campaign's theme editor. You'll find them under Theme Assets:
Entry section — includes the Join Page template, the Thank You Page (the post-signup confirmation page), and others.
Advocate Account Pages section — this is where the auth-gated pages live:
Login Page — the auth screen returning advocates see when accessing Your Rewards.
Create Password Page — the first-time auth screen for new advocates setting a password.
Rewards Page — the auth-gated page where advocates track their rewards, customize their referral link, and update their PayPal email.
Messaging Preferences Page — where advocates manage email notification frequency (linked from email unsubscribe).
To open the theme editor: from your campaign, go to Customize campaign > Themes > click Customize on your active theme.
For broader theme editor guidance, see [Shopify] Customizing your referral emails, pages, and widgets or [Other Platforms] Customizing your referral emails, pages, and widgets.
Article FAQ
Why is the Share Page public but Your Rewards is private?
Why is the Share Page public but Your Rewards is private?
The Share Page is meant to make sharing as frictionless as possible — the goal is to get advocates referring friends, and a sign-in step at that moment would just create drop-off. Anyone with the URL (or who enters the matching email on the Join Page) reaches their referral link directly.
The Your Rewards tab, on the other hand, exposes more sensitive information and actions — the advocate's PayPal payout email, their detailed rewards history, the ability to customize their referral link slug. That content is auth-gated so only the advocate themselves can see or change it.
What if an advocate forgets their password and doesn't have access to their email anymore?
What if an advocate forgets their password and doesn't have access to their email anymore?
Both authentication options — password and sign-in link — depend on the email the advocate signed up with. The Forgot Password recovery flow also goes to that email. If an advocate has lost access to that email account, they should reach out to support so we can help them update or recover their account.
How long does the sign-in link stay valid?
How long does the sign-in link stay valid?
The sign-in link is temporary and unique — it expires after a short window for security reasons. If the link expires before the advocate clicks it, they can just request a new one from the Your Rewards login screen as long as they still have access to the email they signed up with.
Can two different signup widgets (Join Page + Join block, for example) coexist for the same campaign?
Can two different signup widgets (Join Page + Join block, for example) coexist for the same campaign?
Yes. The signup surface (Join Page link, Join block, Embedded signup, Floating Referral Widget) is just the entry point — they all feed into the same Share Page and Rewards page experience described in this article. Many merchants run more than one signup surface at a time: an embedded option on a "Refer a friend" page on their storefront, plus the Join Page link to drop into campaign emails. Each advocate ends up at the same Share Page regardless of which surface they signed up through.
What happens if an advocate changes their custom referral link slug?
What happens if an advocate changes their custom referral link slug?
Their old vanity link stops working the moment they save the new one. Referred friends clicking the old link land on your store URL instead of the friend offer — so any link the advocate had already shared (in DMs, social posts, printed materials, etc.) becomes a dead-end for new referrals.
ReferralCandy shows this warning in the "Customize invite link" popup, but advocates may not pause to read it. If an advocate reaches out asking why their old link "stopped working," this is usually the cause — they (or someone with access to their account) updated the slug.
The advocate can change the slug back to recover the previous link, as long as no other advocate has claimed it in the meantime.