Postback Tracking: How Ad Networks Report Conversions to You
Postback tracking is the server-to-server method an ad network uses to tell your systems a conversion happened. The network calls a URL you control, the postback URL, sending conversion data server to server, bypassing browser pixels. It is the backbone of mobile, affiliate, and paid-social attribution.
TL;DR
- A postback is an inbound server-to-server call from an ad network to your endpoint when a conversion occurs, not an outbound pixel.
- It survives ad blockers and cookie loss because nothing depends on the user's browser.
- Postback URLs carry parameters like transaction ID, payout, and sub IDs that you map back to the original click ID.
- Security and debugging matter: validate the sender, log every call, and reconcile against your own records.
- Postbacks feed your attribution model; they are the intake, not the model itself.
What Is a Postback URL and How Does It Work?
A postback URL is an endpoint you host, such as https://yourdomain.com/postback, that an ad partner is allowed to call. When a user who clicked your ad later converts, the partner's server sends an HTTP request to that URL with details about the conversion. Your server receives it, matches it to the original click using an ID passed in both places, and records the conversion.
The key difference from pixel tracking is direction. A pixel fires from the user's browser outward to the network. A postback fires from the network's server inward to yours. That inversion is exactly why postbacks are resilient to browser signal loss, which is the same problem that makes server-side tracking valuable for web events.
Postback vs Pixel vs Server-Side Tracking: What Is the Difference?
| Method | Direction | Survives blockers | Typical use |
|---|---|---|---|
| Browser pixel | User browser to network | No | Basic web conversion tracking |
| Server-side event | Your server to network | Yes | Web events sent via the Conversions API |
| Postback | Network server to your server | Yes | Mobile, affiliate, and partner conversions |
A Conversions API setup pushes your events to a platform. A postback is the partner pushing conversion confirmations to you. They solve opposite halves of the same attribution problem, and mature stacks use both.
What Parameters Does a Postback Carry?
- Transaction or conversion ID: a unique record of this specific conversion.
- Click ID or sub ID: the value you passed when the user clicked, used to match the conversion to the source.
- Status: often approved, pending, or rejected for affiliate and payout models.
- Payout or value: the revenue or commission tied to the conversion.
- Timestamp: when the conversion occurred on the partner side.
The match key is everything. If the click ID you stored at click time is not the same ID the partner echoes back, you cannot connect the conversion to its source, and the postback is useless for attribution.
What Are Postback Macros?
Macros are placeholders in your postback URL that the partner replaces with real values at call time. A URL might look like https://yourdomain.com/postback?clickid={clickid}&payout={payout}&status={status}. The braces tell the partner where to inject the live data. You define which macros the partner supports, then read those fields in your endpoint. Getting the macro names right is the difference between a postback that populates your database and one that arrives empty.
How Do You Set Up Postback Tracking?
- Generate a unique click ID when a user clicks your ad and store it with the session.
- Pass that ID to the partner as a sub ID or click ID parameter in the offer link.
- Host a postback endpoint that reads the returned ID and records the conversion against the stored session.
- Require a shared secret or token so only the partner can trigger a valid conversion, then log every request.
- Reconcile daily: compare postbacks received against conversions your own system recorded, and investigate mismatches.
How Do You Secure a Postback Endpoint?
Anyone who learns your postback URL could forge conversions. Protect it the same way you would any trusted server integration. Require a shared secret or token that only you and the partner know, verify the request actually came from the partner's expected source where possible, and never expose payout logic on a URL that can be called by anyone. Log every call so you can replay and debug later, and alert on sudden volume spikes that suggest fraud or a broken partner feed.
How Do You Debug Postback Tracking?
Most postback problems are matching failures, not delivery failures. Start by checking that the click ID you stored matches the ID the partner returns. Then confirm your endpoint is reachable and not throwing errors. Use a logging table that captures the raw request, the parsed fields, and the match result for every call. If a partner shows conversions but your system shows none, the gap is almost always in the ID handoff, which is exactly what your Google Ads conversion setup logging would reveal for web events too.
How Does Postback Tracking Work in Mobile Attribution?
Mobile measurement partners such as adjust, appsflyer, and branch sit between your app and the ad networks. When a network claims an install or in-app event, the measurement partner receives the postback and forwards a cleaned version to you. This is why postbacks are the default for app install attribution: the conversion happens inside another company's app store or SDK, so your only signal is the server-to-server callback. The same pattern applies to affiliate networks and to any partner that completes the sale on its own system.
Where Does Postback Tracking Fit in Modern Attribution?
Postbacks do not replace your overall measurement stack. They are the intake mechanism for conversions that happen outside your own site or app, especially in mobile app installs, affiliate partnerships, and closed-loop offline conversion tracking where a sale completes by phone or in person. Treat the postback as a trusted signal source that feeds your attribution model, not as the model itself, and reconcile it against your first-party records so a faulty partner feed cannot silently corrupt your numbers.
What Is Postback Fraud and How Do You Detect It?
Because a postback fires to a known URL, bad actors can replay or forge it to claim conversions they did not earn, especially in affiliate and payout models. Detect it with basic hygiene: require a rotating secret so old URLs cannot be reused, cap conversions per click ID, and watch for impossible patterns like thousands of conversions from one source. Reconcile partner reports against your own source of truth daily, and treat a sudden spike in approvals without a matching rise in real revenue as a red flag. The logging table you built for debugging doubles as your fraud audit trail.
How Do You Document a Postback Spec for a Partner?
Before launch, write a one-page spec so both sides agree on the contract. List the exact postback URL, the macros the partner will populate, the expected method, and the fields your endpoint requires. State the match key explicitly: which click ID at click time maps to which parameter at conversion time. Include a sample raw request and the expected parsed result. A written spec turns a fuzzy integration into a checklist you can test, and it prevents the most common failure where the partner sends a different parameter name than your endpoint expects.
How Do Postbacks Relate to Skadnetwork and iOS Privacy?
On iOS, Apple's SKAdNetwork delivers conversion signals from installed apps back to ad networks as aggregated, delayed postbacks rather than real-time user-level data. That is the same server-to-server idea, applied under strict privacy limits: the postback arrives, but it carries coarse conversion values and a timer, not a precise event log. If you run iOS app campaigns, your measurement partner translates SKAdNetwork postbacks into the attribution you see, and you should design your conversion value schema so the coarse signal still tells you something useful about downstream revenue.
Frequently Asked Questions
What Is a Postback in Simple Terms?
A postback is a call from an ad network's server to your server saying the user you sent me just converted. It delivers the news directly, without depending on the user's browser.
Is a Postback the Same as Server-Side Tracking?
No. Server-side tracking is you sending events from your server to a platform. A postback is the platform or partner sending conversion data back to your server. They move in opposite directions.
Why Are Postbacks More Reliable Than Pixels?
Pixels rely on the user's browser, which can block them with ad blockers, private mode, or cookie settings. Postbacks travel server to server, so the user's browser never gets in the way.
What Breaks Postback Tracking Most Often?
A mismatch in the click ID or sub ID handed off at click time. If the ID the partner returns is not the one you stored, you cannot tie the conversion to its source.
Do I Need Postbacks If I Only Run Web Ads?
Usually not for basic web conversion tracking, where a pixel or Conversions API covers you. You need postbacks when conversions happen in a partner's system, in a mobile app, or offline and must be reported back to you.