Postback URL
A postback URL is a web address that one server calls to report a conversion to another server. It carries a stored click ID plus conversion details such as payout, order ID, and event type from the advertiser’s system back to the tracking platform or affiliate network that sent the click. Because the call happens server to server, it records the conversion without cookies, JavaScript, or the user’s browser.
Why Postback URLs Matter
A postback is the most durable conversion signal available. Browser-based tracking loses data to ad blockers, Safari’s Intelligent Tracking Prevention, and short cookie lifetimes. A server-to-server call skips all of that: the advertiser’s backend talks directly to the tracker once the order is confirmed.
Three practical consequences:
- Payouts are accurate. Affiliate commissions are calculated from postback data, so a postback that never fires is a commission that never gets paid.
- Refunds stay controllable. Conversions post after the transaction clears, and a later status update reverses a refunded or rejected order.
- Offline conversions still count. A sale closed in a CRM or a call center can be posted back, because the click ID lives in the record rather than the browser.
How a Postback URL Works
Four steps, in order:
- Click. Someone clicks a tracking link. The tracker redirects them to the landing page and appends a unique click ID, for example
?click_id=a1b2c3. - Store. The landing page or server saves that click ID against the session, lead, or order, usually in a first-party cookie, a hidden form field, or a database column.
- Convert. The visitor buys, signs up, or installs, and the advertiser’s server confirms the transaction.
- Post back. That server sends an HTTP request to the tracker’s postback URL with the stored click ID and the conversion values.
https://tracker.example.com/postback?cid=a1b2c3&payout=25.00&txid=ORD-88421&goal=sale
Most platforms accept a plain GET request and reply with HTTP 200 and a short body such as ok. The request comes from the server. If a browser makes it, it is not a postback.
Postback URL Parameters
Trackers publish a postback template with macros the advertiser replaces at runtime. Parameter names are platform-specific: Voluum expects cid and payout, while others use clickid, subid, or transaction_id for the same value. Copy the template from the platform instead of inventing names.
| Macro | What it carries |
|---|---|
{click_id} |
The identifier issued at redirect. Required. Nothing matches without it |
{payout} or {sum} |
Commission or revenue for this conversion |
{transaction_id} |
The advertiser’s order ID, used to deduplicate repeat calls |
{goal} or {event} |
Which action fired: lead, sale, install, upsell |
{status} |
approved, pending, or rejected, for later reversals |
{currency} |
ISO code when payouts span multiple markets |
A postback credits the click ID, not the channel. Keeping the same links tagged with campaign parameters through an affiliate UTM builder means the source and campaign stay readable in analytics next to the network’s payout report.
Types of Postback URLs
- Global postback. One URL applied to every offer in an account. Set it once and every campaign reports through it.
- Offer-level postback. A separate URL per offer, used when payouts, goals, or parameter names differ.
- Event or goal postback. A distinct URL or goal value per event, so a lead and a sale are not counted alike.
- MMP postback. Mobile measurement partners (AppsFlyer, Adjust, Branch) send install and in-app event postbacks to ad networks.
- SKAdNetwork postback. Apple sends these itself for iOS campaigns. They are aggregated, randomly delayed, and carry no click ID.
Postback vs Pixel
A postback fires from a server. A tracking pixel fires from the browser. That single difference drives every other trade-off.
| Postback URL | Tracking pixel | |
|---|---|---|
| Fires from | The advertiser’s server | The user’s browser |
| Requires a stored click ID | Yes | No, it reads a cookie |
| Affected by ad blockers and ITP | No | Frequently |
| Records offline or CRM conversions | Yes | No |
| Setup | Developer work on the backend | Paste a snippet on the thank-you page |
| Reports order value reliably | Yes | Only if the page loads fully |
Use postbacks anywhere real money moves: affiliate payouts, partner commissions, lead resale. Pixels stay acceptable for low-stakes measurement with no developer available. Many teams run both and deduplicate on the transaction ID, the pattern used in server-side tracking setups.
Common Postback URL Issues
- The click ID was never stored. This is the top cause of missing conversions. If the landing page drops the parameter on redirect or on a form submit, there is nothing to post back.
- Duplicate conversions. A retried request or a refreshed order confirmation fires the postback twice. Send a unique transaction ID and let the tracker deduplicate.
- It fires from the browser. Putting the postback URL in an image tag or a JavaScript call makes it a pixel with extra steps, and it inherits every browser limitation.
- No security token. A postback URL that leaks can be called by anyone. Add a secret key parameter or allowlist the advertiser’s server IP addresses.
- Unencoded values. Spaces, ampersands, and currency symbols break the query string. URL-encode every dynamic value.
- Never tested. Fire a manual call with a known click ID before launch and confirm it lands in the tracker.
Frequently Asked Questions
What is a postback URL?
A postback URL is an endpoint that an advertiser’s server calls to report a conversion to a tracking platform or affiliate network. The call includes the click ID that was issued when the user clicked, along with the payout, order ID, and event type. The tracker matches that click ID to the original click and credits the conversion to the right partner or campaign.
What is a server-to-server (S2S) postback?
An S2S postback is the same mechanism named for how it travels: one server sending conversion data directly to another, with no browser involved. Postback URL, S2S postback, and server-side postback are used interchangeably in affiliate and performance marketing. Server calls are not blocked by ad blockers, cookie restrictions, or JavaScript failures.
Postback vs pixel: which is more reliable?
Postbacks are more reliable. A pixel depends on the browser loading a script or image on the confirmation page, which ad blockers, privacy settings, and abandoned loads all interrupt. A postback fires from the server after the transaction is confirmed, so it also captures offline and CRM conversions. The trade-off is setup: pixels are copy-paste, postbacks need backend work.
How do you set up an affiliate postback URL?
Copy the postback template from the network, then pass the click ID through your funnel. Capture the click ID parameter on the landing page, store it with the lead or order, and have your server call the postback URL with that value plus the sale amount at checkout. Everflow, Voluum, RedTrack, and Impact all follow this pattern. The wider mechanics are covered in affiliate link tracking.
Do postback URLs work without cookies?
Yes. That is the main reason they exist. The click ID can be stored in a database row or a hidden form field instead of a cookie, which makes postback conversion tracking immune to third-party cookie deprecation and browser privacy limits.
To build and tag the campaign links that feed your postback click IDs, use the free UTM builder at linkutm.