What a postback is
A server-to-server (S2S) postback is a direct call from one server to another announcing that a conversion happened. No browser is involved. When a player deposits, the casino's server calls the network's endpoint and says so.
That is why it is the standard. A browser-side pixel needs the player's browser to still be on a page, with tracking unblocked, before they navigate away. A server call needs none of those things.
What it contains
| Field | Purpose |
|---|---|
| Click ID | Ties the conversion back to the click, and therefore to the affiliate |
| Event type | Registration, first-time deposit, redeposit. What actually happened |
| Amount and currency | The deposit or revenue figure the commission is calculated from |
| Transaction ID | A unique id for this event, so a retry does not pay twice |
| Timestamp | When it happened, also used to reject stale replays |
| Signature | Proof the call really came from the operator |
Why it is signed
A postback creates money. An unsigned endpoint that accepts any well-formed call is an endpoint anyone can call, which is why serious networks require a signature over the payload, typically an HMAC computed with a shared secret plus a timestamp so a captured call cannot be replayed later.
- Keep the shared secret server side only. It never belongs in a browser, an app bundle or a public repository.
- Sign the values you send, not just the fact that you sent something.
- Send the timestamp and keep clocks roughly in sync. A freshness window will reject calls that look too old.
- Expect an IP allowlist on the receiving end, and tell the network which addresses you will call from.
Integrating without losing conversions
- Agree the parameter names in both directions. The single most common integration failure is the operator returning the click ID under a different name than the network expects.
- Fire on the events that matter, at minimum registration and first-time deposit, separately rather than merged.
- Retry on failure with the same transaction ID, and log what you sent.
- Test with a real click. Click a tracking link, register, deposit, and confirm the postback arrives carrying that click ID.
- Only then scale traffic. Every conversion sent before the round trip works is a conversion nobody can attribute afterwards.
If you are integrating with us, your account manager supplies the endpoint, the parameter map and the secret, and tests the round trip with you before anything goes live. The chain this sits at the end of is described in how affiliate tracking works.
