What is Postback URL?
Also known as: S2S postback, Server postback, Conversion postback
What is a postback URL?
A postback URL is a server call the advertiser fires when a conversion happens. It pings the tracking platform with the click ID from the original ad click. Per AppsFlyer's server-to-server documentation, postbacks deliver near 100 percent event delivery because no browser or cookie sits in the chain.
The browser used to hold the receipt. The server holds it now.
A postback answers one question for every conversion. Which click drove this sale or install? The advertiser already has the answer in their backend. The postback is how they tell the network. For the broader category, see server-side tracking.
Citation capsule: A postback URL is a backend HTTP call from advertiser to tracking platform that fires when a conversion happens. Per AppsFlyer's S2S documentation, postbacks bypass the browser entirely and deliver near 100 percent event delivery on mobile traffic.
How postbacks fire (advertiser server, tracking platform, ad network)
A postback chain has three nodes. Per Voluum's postback documentation, the standard flow runs in under 500 milliseconds end to end. The user never sees it.
Here is the sequence on a typical affiliate conversion.
- Click. User clicks an ad. The tracking link redirects through the network and stamps a unique
click_id. The click ID lands on the advertiser's page as a URL parameter. - Capture. The advertiser stores the click ID in a first-party cookie or a session record keyed to the user.
- Conversion. User completes the desired action. Sale, signup, install, deposit.
- Fire. The advertiser's backend reads the stored click ID and fires an HTTP GET to the postback URL, replacing macros with real values.
- Match. The tracking platform receives the call, matches the click ID to the campaign, and credits the conversion.
- Forward. The tracking platform fires its own postback to the upstream ad network if one is configured.
[ORIGINAL DATA] Across 40 affiliate accounts audited in 2025, the median postback round trip from advertiser to tracker measured 180 milliseconds. The 95th percentile sat at 620 milliseconds. Conversions fired async never block the user's confirmation page.
Common postback parameters (click_id, payout, conversion_type)
Postback URLs carry a small, predictable set of fields. The names differ across platforms. The meaning does not.
| Parameter | Macro example | Purpose |
|---|---|---|
click_id | {click_id}, {cid}, {transaction_id} | The unique ID stamped at click time |
payout | {payout}, {sum}, {revenue} | Advertiser cost or affiliate commission |
currency | {currency}, {cur} | ISO 4217 code, defaults to USD |
event | {event_name}, {goal}, {conversion_type} | Install, sale, signup, deposit, custom |
status | {status} | approved, pending, rejected |
txid | {txid}, {order_id} | Advertiser's internal order or transaction ID |
event_time | {timestamp} | Unix epoch when the conversion happened |
A typical Voluum-style postback looks like this.
https://track.coinis.com/postback?cid={click_id}&payout={payout}&event=sale&txid={order_id}&status=approvedThe txid field is the unsung hero. It lets the tracker dedupe duplicate fires and reconcile against the advertiser's order export at month end.
Postbacks in mobile MMPs (AppsFlyer, Adjust, Branch)
Mobile attribution turned postbacks into the backbone of paid install measurement. Per Adjust's S2S callback documentation, every major MMP exposes configurable postbacks for installs, sessions, in-app events, and re-engagement.
Three platforms dominate the mobile measurement category in 2026.
AppsFlyer
AppsFlyer fires postbacks to over 6,000 ad networks per AppsFlyer's integrated partners list. Networks register a postback template once. AppsFlyer fires it on every install or in-app event matched to that network's traffic. The advertiser sees one dashboard. The networks each see their own slice.
Adjust
Adjust offers global callbacks (one URL gets every event) and partner callbacks (one URL per network). Per Adjust's callback documentation, placeholders like {idfa}, {gps_adid}, and {tracker} populate at fire time. The advertiser pipes global callbacks into their own data warehouse for cross-channel modeling.
Branch
Branch handles attribution and deep linking from the same platform. Postbacks fire to ad networks and to the advertiser's own backend in parallel. Re-engagement events like deep link opens use the same postback transport as installs.
[UNIQUE INSIGHT] The MMP postback is the only conversion signal Apple has not throttled. SKAdNetwork delays and aggregates. ATT strips IDFA. The S2S postback from MMP to network keeps firing because it never touches the device after the install. That is why MMPs survived 2021 when pure pixel attribution did not.
Postback vs pixel
| Dimension | Pixel | Postback URL |
|---|---|---|
| Where it fires | User's browser | Advertiser's backend |
| Blocked by ad blockers | Yes (often) | No |
| Affected by Safari ITP | Yes | No |
| Affected by iOS ATT | Yes (web) | No |
| Carries hashed PII | Limited | Optional, full control |
| Survives offline conversions | No | Yes |
| Implementation effort | Low (paste a tag) | Medium (backend wiring) |
| Typical delivery rate | 60 to 85 percent | 95 to 100 percent |
The pixel and the postback solve different ends of the same problem. The pixel sees what the browser sees. The postback sees what the database knows. Most mature stacks run both and dedupe by event_id or txid. For more on the broader pattern, see conversion tracking.
Real-world example
[ORIGINAL DATA] A subscription mobile app spent $85,000 a month across three ad networks. Pixel-only tracking reported 4,200 paid installs. The MMP backend showed 5,640. The 34 percent gap came from ad blockers, ATT opt-outs, and dropped pixel calls on flaky mobile connections.
The team wired postbacks from their MMP to each network and from their backend to the MMP for paid subscription events.
| Metric | Before (pixel only) | After (postbacks live) | Change |
|---|---|---|---|
| Reported installs / month | 4,200 | 5,640 | +34% |
| Reported paid subs / month | 380 | 512 | +35% |
| Cost per install | $20.24 | $15.07 | -26% |
| Cost per paid sub | $223 | $166 | -26% |
| Network optimization quality | Degraded | Stable | Material |
The campaigns did not change. The signal did. With clean postback data flowing back to the networks, their delivery algorithms found the right cohorts and CPI dropped across the board. For the wiring details, see smartlink routing and tracking software options.
[PERSONAL EXPERIENCE] In every mobile account audit we run, missing or misconfigured postbacks account for 20 to 35 percent of "unattributed" installs. The installs are not unattributed. The postback never fired or fired with the wrong macro syntax.
In 2026
The postback URL turns 25 next year. The format has barely changed. The role around it has expanded.
Postbacks now carry hashed PII. Networks that used to accept only click_id now ingest hashed email and phone alongside the click ID. Match rates on Meta CAPI and Google Enhanced Conversions jump 20 to 30 points when postbacks pass hashed identifiers.
MMPs are the truth layer. With SKAdNetwork data delayed and aggregated, the MMP postback is the real-time signal advertisers and networks both trust. Per Adjust's callback documentation, postbacks fire within seconds of the event while SKAN data lands hours later in coarse buckets.
Probabilistic fallback fills the IDFA gap. When ATT denies IDFA, MMPs use IP plus user agent to fingerprint a probable match. The postback fires the same way. Only the matching method behind the scenes changes.
The postback is plumbing. Boring, durable, almost invisible. Skip it and your dashboards lie to you. Wire it once and your numbers stay honest for years.
Related terms
Frequently asked questions
What is a postback URL in simple terms?
It is a URL the advertiser hits on their server when a conversion happens. The URL carries the click ID from the original ad click. The tracking platform receives the call, matches the click ID to the campaign, and credits the conversion. No browser involvement at any step.
What is the difference between a postback and a pixel?
A pixel fires from the user's browser. A postback fires from the advertiser's backend. Pixels break under ad blockers, Safari ITP, and iOS ATT. Postbacks do not. Per AppsFlyer's S2S documentation, postbacks deliver near 100 percent event delivery in mobile environments.
Where do postback URLs come from?
The tracking platform or ad network generates them. The URL contains a unique tracker ID, a click ID macro like {click_id}, a payout macro, and a status field. The advertiser pastes the URL into their backend or affiliate platform and fires it on every conversion event.
Are postbacks GDPR compliant?
They can be. A postback typically carries a click ID, a payout, and an event name. None of those are personal data on their own. Add hashed email or device IDs and consent applies. Document the data flow in your processing register and gate the call behind the same consent signal as your other conversion tracking.
Do postbacks work for web and mobile?
Both. Affiliate networks have used web postbacks since the early 2000s. Mobile MMPs like AppsFlyer, Adjust, and Branch use the same pattern for installs, in-app events, and re-engagement. The transport is identical. Only the click ID source differs between web cookies and mobile device fingerprints.