Postback (S2S) tracking explained for iGaming affiliates
A postback is the server-to-server request an operator's system sends to your tracker when a player registers or deposits. How it works, what the URL carries and how to test it.
A postback is an HTTP request that an operator's or affiliate program's server sends to your tracker when a player you referred converts, such as a registration or first deposit. Because this server-to-server (S2S) postback carries the click ID, the tracker can credit the conversion to the right click, traffic source and campaign with no browser involved.
For a media buyer, this data turns a spend report into a profit report: it shows which sources bring depositors, not only clicks.
What is a postback?
In affiliate marketing, a postback is a conversion tracking method: a notification sent from one server to another when a tracked event happens. The system that records the conversion, usually the operator's affiliate software or an affiliate network, makes the call. Your affiliate tracker receives it and writes the conversion against the original click.
You will also see it called server-to-server tracking, a server postback or a callback; on postback vs callback, affiliate platforms use the words interchangeably. The postback URL is the address on your tracker that the program calls.
One caveat for developers: in ASP.NET Web Forms, a postback is a page submitting its form back to its own server, which has nothing to do with conversion tracking.
How postback tracking works, step by step
Postback tracking sends a click ID out with each visitor and gets it back in a server request when that visitor converts, so the tracker can match the conversion to the click. Here is one click from start to finish, with invented IDs and domains.
The click. A user taps your ad and hits your tracking URL, a trackable link that points at your tracker first, such as
https://trk.example.com/c/41. The tracker logs source, campaign, creative, device and time, and gives the click a unique ID, say7f3a9c21.The hand-off. The tracker redirects the user to the program's offer link and appends the click ID in the parameter the program reserves for it, often called a sub ID:
https://go.example-casino.com/o/12?sub1=7f3a9c21.The registration. The program stores the click ID on the new player account. When sign-up completes, its server sends a postback request to your tracker with that ID and the event name.
The deposit. Days later the player funds the account for the first time. The program fires a second request for the same click ID, now with a payout and a pending status.
The decision. After the program's review, a status update marks the deposit approved or rejected.
The forward. Your tracker matches each request to click
7f3a9c21, updates that campaign's revenue, and can forward the deposit to the ad platform so its bidding optimizes toward depositors.
Timing differs by event. A registration usually arrives within minutes. A first deposit can land days after the click, and approval follows the program's hold, which often runs a few weeks. Treat the latest days of any report as incomplete.
What a postback URL looks like
A postback URL has two parts: the base address on your tracker and a query string of parameters. Parameter names belong to your tracker. Each value is a macro, a placeholder the program replaces with real data when the request fires.
An illustrative template, as entered in the program's dashboard:
https://trk.example.com/postback?clickid={clickid}&event={event}&payout={payout}¤cy={currency}&txid={transaction_id}&status={status}
The same request as your tracker receives it after a first deposit:
https://trk.example.com/postback?clickid=7f3a9c21&event=ftd&payout=150.00¤cy=USD&txid=88412&status=pending
It is typically a plain HTTP GET request, with all the postback data in the URL.
| Parameter | What it carries | Why you need it |
|---|---|---|
| Click ID | The ID your tracker created, sent back | The only link between a conversion and its click |
| Event | Registration, FTD, repeat deposit | Lets you pay and optimize per event |
| Payout | Your commission for this event | Puts revenue and ROI into reports |
| Currency | USD, EUR and so on | Keeps mixed currencies out of totals |
| Transaction ID | A unique ID for this conversion | Deduplication and repeat events on one click |
| Status | Pending, approved, rejected | Separates money on hold from money earned |
Macro syntax is not standard: one platform uses curly braces, another hash marks, and parameter names vary by tracker. Copy both from the program's and the tracker's docs.
Which events get sent in iGaming
In iGaming, programs typically report registrations, first deposits and their status changes, and one player can produce several postback conversions, depending on the program and your deal.
Registration. The player opens an account. An early signal, and the paid event on CPL deals.
FTD (first-time deposit). The event most CPA deals pay on. The payout field may carry the CPA amount, or zero on a RevShare deal.
Qualified FTD. Some programs send a separate event once the deposit meets the deal's baseline, such as a minimum deposit or wagering.
Repeat deposits. Sent by some programs; useful for judging player value.
Status changes. A pending FTD becomes approved, or rejected after duplicate-account, bonus-abuse or traffic-source checks. A chargeback can reverse it later.
RevShare earnings usually settle in monthly reports rather than by postback, though some platforms send revenue updates. CPA vs RevShare vs Hybrid explains how each model pays.
Not every program offers postbacks, and some platforms enable only the registration event by default, so ask before you build. Bidding and cutting sources on approved FTDs, not registrations, ties your decisions to the event you are paid for.
Postback vs pixel tracking: why S2S is the default
S2S is the default because the request fires from the program's server, so cookie limits, ad blockers and late events do not cost conversions the way they do with a browser pixel.
A pixel is a snippet that loads in the player's browser, usually on a confirmation page, and calls your tracker from there. It works only if that browser still holds the click's cookie and lets the request out.
Browsers make both harder. Safari has blocked third-party cookies by default since March 2020. Since 2019 its tracking prevention has also capped cookies set by scripts at seven days. Ad blockers can stop pixel calls entirely. A server request avoids all of this.
| S2S postback | Pixel | |
|---|---|---|
| Fires from | The program's server | The player's browser |
| Matches the click by | Click ID in the URL | Usually a cookie |
| Ad blockers, cookie limits | Not affected | Can lose conversions |
| Events days or weeks later | Sent when they happen | Only if the player loads a page with the pixel |
| Setup | URL and macros on both sides | Code on the advertiser's page |
Pixels remain where a program has no server option, or on landing pages you control. Cookie-based attribution is also easier to abuse, as cookie stuffing shows.
Ad platforms run the same server-side logic. Meta's Conversions API takes events from your server. As of October 2026, Meta's recommended deduplication method matches a pixel event and a server event on the same event ID and event name, and merges them only if both arrive within 48 hours.
How to set up and test a postback
Setup means matching settings in the program and in your tracker: the click ID goes out on the offer link, your tracker's URL goes into the program's dashboard, and a test conversion proves both work.
Collect the details. From the affiliate manager or the program's docs, get the click ID parameter, supported macros, available events and statuses, and whether the URL is set per offer or globally.
Build the URL in the tracker. Most trackers generate a template for programs they know. For any other program, map each tracker parameter to its macro by hand.
Pass the click ID out. Add it to the offer link in your tracker campaign, in the program's sub ID parameter.
Install the URL. Paste it into the program's dashboard, one entry per event if required.
Map statuses. Pending, approved and rejected should land as separate states.
Test delivery. Open your campaign link in a clean browser session, confirm the click ID reached the program, then complete a test sign-up or ask the affiliate manager to fire a test postback.
Read the log. Some platforms log each postback request with your server's response code. A 200 means your tracker accepted it; a 4xx or 5xx points at your endpoint.
Serve the tracker endpoint over HTTPS, and retest whenever either side changes its link format.
Common postback problems and how to fix them
Most tracking problems come from a click ID lost on the way out, a wrong macro or parameter, or requests that never reach the tracker. The fix usually starts with tracing one click end to end and comparing both sides' logs.
Click ID lost on the way out. A prelander or extra redirect drops the query string. Follow the chain hop by hop and look for the ID in the program's click report.
Wrong macro or parameter name. Some platforms treat parameter names as case-sensitive and ignore any other spelling, so the click ID comes back empty. Copy names and macros exactly.
Broken URL. Unencoded values, stray spaces or a second
?where an&belongs corrupt the request.Status mapping. If pending deposits count as approved, ROI looks better than it is until rejections arrive.
Duplicates. Retries can fire one event twice, so base deduplication on the transaction ID. At least one widely used tracker counts each click ID and transaction ID pair once and, by default, discards a repeat click ID without a new transaction ID.
Requests never arrive. Downtime, an expired certificate or a firewall rule can block incoming calls. Compare the program's request log with your tracker's.
Totals that disagree with the operator report. Late approvals, rejected FTDs, currency conversion and report cut-off times all open gaps. Rejections are also how operators filter fraud; see iGaming affiliate fraud.
FAQ
What is a postback URL?
A postback URL is the address on your tracker that an affiliate program calls when a conversion happens. The program's macros fill in its parameters, such as click ID, event, payout and status.
What does "postback" mean in affiliate marketing?
In affiliate marketing, a postback is a server-to-server notice that a referred player converted. The operator or network tells your tracker which click produced the registration or deposit, and what it pays you.
What is a tracking URL and how is it different from a postback URL?
A tracking URL is the link your traffic clicks; it records the click and creates the click ID. The program calls the postback URL later, to report what that click turned into.
Postback or pixel: which is more reliable?
As a rule, S2S tracking is more reliable than a pixel for operator programs. It needs no browser cookie, ad blockers do not see it, and late approvals still arrive. A pixel is quicker to install but can miss conversions in browsers that limit cookies.
How do I test that a postback is working?
To test a postback, click your own campaign link, confirm the program received the click ID, then trigger a test postback. The tracker should log the right event and payout, and any request log on the program's side should show a 200 response.
Why does my tracker show fewer conversions than the operator?
A tracker usually shows fewer conversions than the operator because of a click ID lost in a redirect, a wrong macro, or an event the program does not send. More conversions in the tracker than in the operator report usually means pending FTDs that were later rejected.
Sources
Everflow Helpdesk, "Understanding tracking with server-to-server postbacks"
Everflow Helpdesk, "How to test partner postbacks"
Voluum Documentation, "Parameters in Postback URLs"
Voluum Documentation, "Upselling: Tracking subsequent conversions"
Offer18 Knowledge Base, "iGaming - Postback"
Referly Help Center, "Postback URL"
Meta for Developers, "Handling Duplicate Pixel and Conversions API Events"
Microsoft Learn, "Page.IsPostBack Property"
