What a postback is
A server-to-server (S2S) postback is a direct call from the casino's server to the network's, announcing that a conversion happened. No browser is involved, so nothing on the player's side can block or lose it. It is the last step of the tracking chain.
What it contains
| Field | Purpose |
|---|---|
| Click ID | Ties the conversion to the click, and therefore to the affiliate |
| Event type | What happened: registration, first-time deposit, redeposit |
| Amount and currency | The value of the event, reported alongside it |
| Transaction ID | A unique id for this event, so a retry is not counted twice |
| Status | Optional. A cancellation such as a chargeback reverses the event with the same transaction ID |
| Timestamp | When it happened, also used to reject stale replays |
| Signature | Proof the call really came from the operator |
Why it is signed
A postback creates money, and an endpoint that accepts any well-formed call is an endpoint anyone can call. Serious networks require a signature over the payload, typically an HMAC computed with a shared secret, plus a timestamp so a captured call cannot be replayed later.
- Keep the shared secret server side only: never in a browser, an app bundle or a public repository.
- Send the timestamp and keep clocks roughly in sync. A freshness window rejects calls that look too old.
- Expect an IP allowlist, and tell the network which addresses you will call from.
Integrating without losing conversions
- Agree the parameter names in both directions. The most common failure is the operator returning the click ID under a different name than the network expects.
- Send registration and first-time deposit as separate events, not merged.
- Retry on failure with the same transaction ID, and log what you sent.
- Test with a real click: open a tracking link, register, deposit, and confirm the postback arrives carrying that click ID.
- Only then scale traffic. A conversion sent before the round trip works cannot be attributed afterwards.
If you are integrating with us, your account manager supplies the endpoint, the parameter map and the secret, and tests the round trip with you before anything goes live.
