Quick answer: A postback URL is a link your tracker gives you, which the affiliate network or casino program calls from its server whenever one of your players converts. It carries your click ID, and often the payout and event type, so your tracker records the registration or first deposit without relying on cookies in the player's browser.
I'm Rihards, founder of Seven Affiliates, and I've spent five years in iGaming. If you buy traffic, a working postback is the difference between knowing which campaign makes money and guessing with confidence.
Think of a postback as a carrier pigeon between two servers. [Clears throat, prepares extended pigeon metaphor.] When it arrives, your tracker learns a player deposited. When it gets lost, you keep paying for clicks that look worthless and quietly aren't, which is the most expensive way to be wrong.
How does a postback URL work?
Your tracker creates a unique click ID for every visitor, passes it into the offer link, and waits. When that visitor registers or deposits, the program's server calls your postback URL with the same click ID, and your tracker matches the conversion to the click. AnyTrack puts it neatly: "A postback URL is a URL that one server calls to notify another server that a conversion happened."
The important bit is that steps 3 and 4 happen between servers. The player's browser, their cookie settings and their ad blocker never get a vote, which is lovely, because those three have been voting against affiliates for years.
Postback vs pixel: what's the difference?
A pixel fires from the player's browser and depends on cookies. A postback fires from the program's server and doesn't. RedTrack notes a postback "doesn't rely on cookies or client-side scripts", while a pixel can even double-count when someone refreshes the thank-you page (the tracking equivalent of clapping twice at your own joke).
| Pixel | Postback (server-to-server) | |
|---|---|---|
| Fires from | The player's browser | The program's server |
| Needs cookies | Yes | No, it uses the click ID |
| Ad blockers and browser privacy | Can block or shorten it | Not affected |
| Duplicates on page refresh | Possible | Controlled with a transaction ID |
| Setup effort | Paste a code snippet | Match tokens between two systems |
Browsers have made pixels steadily shakier.
Apple's WebKit team announced in 2019 that with ITP 2.1, "all persistent client-side cookies, i.e. persistent cookies created through document.cookie, are capped to a seven day expiry" (WebKit). A player who clicks on Monday and deposits the following Wednesday may simply vanish from a pixel's memory. Postbacks don't care what day it is, which makes them better company than most of us before coffee.
What goes inside a postback URL?
At minimum, the click ID. Everything else is optional but useful: payout, event type and a transaction ID. Here's the shape, with the tokens in green that the program swaps for real values:
| Part | What it does | Required? |
|---|---|---|
| Click ID | Ties the conversion to the exact click in your tracker | Yes, always |
| Payout | Tells your tracker what the conversion earned you | Optional, but you want it |
| Status or event | Says what happened: registration, deposit, qualified player | Depends on the tracker |
| Transaction ID | Keeps repeat events separate, so two deposits aren't read as one | Optional |
If you only remember one thing, remember the click ID. It's the pigeon's leg tag, and a pigeon without one is just a bird wandering into a server room looking confused.
What do postback URLs look like in popular trackers?
Every tracker names its parameters differently, which is the industry's way of keeping us humble. Two real templates, straight from the documentation:
| Tracker | Required parameters | From the docs |
|---|---|---|
| Voluum | cid (the click ID) is the only mandatory one | Voluum postback parameters |
| Keitaro | subid and status are both mandatory | Keitaro postback docs |
Keitaro's template, for example, is http://IP/postback-key/postback?subid=REPLACE&status=REPLACE&payout=REPLACE, and its standard statuses include registration, deposit, lead, sale and rejected. Leave out the status in Keitaro and the postback is ignored, which is a very quiet way to lose a weekend.
Voluum passes its click ID into the offer through a link parameter such as s2={clickid}, and its txid "is used to pass a unique transaction ID for each conversion" (Voluum). Useful when one player deposits twice and you'd like credit for both, as is only fair.
How do you set up a postback URL, step by step?
It's two halves: send the click ID out, then tell the program where to send it back.
Grab a coffee. [Checks own coffee. Empty. Carries on bravely.]
- Copy your tracker's postback template. It's usually in the affiliate network or offer source settings.
- Find the program's click ID parameter. This is the sub ID or payload field in your tracking link, for example
sub1. - Put the tracker's click ID token into that field in your offer link, so every click carries it to the program.
- Swap the template's REPLACE values for the program's tokens: click ID, payout, event.
- Paste the finished postback into the program's dashboard, or send it to your affiliate manager.
- Test it before spending money. Voluum's advice is to "get a correct click ID from Voluum, put it into a postback URL template and activate it to generate a test conversion" (Voluum).
sub1 and comes home as cid. If the names don't line up in both places, the pigeon lands at the wrong house.Step six is the one everybody skips. It's also the one that would have saved them. I say this with love, as someone who would absolutely skip it too if nobody was watching.
Postback URL examples for casino offers
Most casino setups need up to three postbacks: one per event you care about. The tokens below are made-up names to show the pattern, so swap them for the ones in your tracker's and your program's docs before anything goes live. (Copy-pasting my made-up tokens into production is a bold strategy. I don't recommend it.)
Two things make this work. Each event has its own status, so your reports can separate sign-ups from money, and each repeatable event carries a transaction ID, so the second deposit doesn't politely replace the first. Get those right and your stats stop lying to you, which is more than most horoscopes manage.
Which casino events get posted back?
Usually registration and first deposit, and often a "qualified" event when a player meets the CPA criteria. Some platforms can send much more. Affilka, an iGaming affiliate platform, lists postbacks on "player registration, first deposit, any deposit, player qualification, prequalification and disqualification as well as net gaming revenue of a particular player" (Affilka).
| Event | What it tells you | What to optimise on it |
|---|---|---|
| Registration | A player signed up | Early signal, but cheap to fake |
| First deposit (FTD) | A player put money in | The main signal for most campaigns |
| Qualified player | A player met the CPA criteria | What CPA deals actually pay on |
| Revenue or NGR | What the player generated | RevShare value, usually reported later |
Timing matters too. Voluum's MyAffiliates guide warns that postbacks "can be delayed, as they launch postbacks only after they process data", and that MyAffiliates needs HTTP rather than HTTPS postbacks (Voluum). So a quiet hour isn't always a dead campaign. Sometimes it's just a pigeon stuck in traffic.
In practice, revenue for RevShare is usually reported on a delay rather than posted back live, because NGR changes as players keep playing. That's practitioner consensus, not a published standard, so check your program's reporting. If you're still choosing between models, our guide to CPA vs RevShare covers which one suits your traffic.
Why is my postback not firing?
Nine times out of ten, the click ID never made it to the program, or came back under a different name. Here's the checklist, roughly in the order things go wrong:
| Symptom | Likely cause | Fix |
|---|---|---|
| No conversions at all | Click ID token missing from the offer link | Add the tracker token to the program's sub ID field |
| Conversions arrive but don't match clicks | Offer link and postback use different parameter names | Use the same field both ways, for example sub1 out, sub1 back |
| Keitaro ignores the postback | Status missing or unknown | Add a status the tracker recognises (Keitaro) |
| Second deposit overwrites the first | No transaction ID | Pass a unique transaction ID per event |
| Nothing from a MyAffiliates program | HTTPS postback, or several click ID tokens mixed | Use HTTP and one token consistently (Voluum) |
| Conversions show up hours later | The program sends postbacks after processing | Normal for some platforms, so wait before cutting spend |
On the MyAffiliates point, Voluum is blunt: the three click ID tokens "are not interchangeable". Mixing them is like addressing a letter to three different streets and hoping the postman picks the right one. He won't. He has other letters.
What is a global postback?
A global postback is one postback URL set once for your whole account at a program, instead of one per offer. Every conversion from every offer fires to the same address. It saves time, right up until you also add a per-offer postback and every deposit gets reported twice, which feels amazing for about four minutes.
| Global postback | Per-offer postback | |
|---|---|---|
| Set up | Once for the whole account | Separately for each offer |
| Good for | Many offers, one tracker | Different payouts or trackers per offer |
| Main risk | Double firing if you add per-offer ones too | Forgetting to add one to a new offer |
Pick one approach per program and write it down somewhere you'll find it again. Future you is not as organised as present you thinks. Future you is, frankly, a bit of a mess.
Is a postback the same as a webhook?
They're close cousins. Both are one server calling another when something happens. In affiliate tracking, "postback" usually means a simple URL with values in the query string, while a webhook usually sends a fuller data package in the body of the request.
For your day-to-day work the difference rarely matters: if your tracker asks for a postback URL, give the program a postback URL. Calling it a webhook at a networking event will make you sound clever, though, so keep it in your back pocket. [Adjusts imaginary lanyard.]
Can you send postback data to Google Ads or Meta?
Not with the same postback URL, but the ad platforms have their own ways to receive conversions from a server. Meta's Conversions API is "designed to create a connection between an advertiser's marketing data (such as website events, app events, business messaging events and offline conversions)" and Meta's systems (Meta for Developers). Google Ads offers offline conversion imports, so "you can measure what happens in the offline world after your ad results in a click or call to your business" (Google Ads Help).
| Where the conversion goes | How it gets there |
|---|---|
| Your tracker (Voluum, Keitaro and others) | The program's postback, using your click ID |
| Meta ads | Conversions API, usually fed by your tracker |
| Google Ads | Offline conversion import, usually fed by your tracker |
The usual pattern is program to tracker by postback, then tracker to ad platform through its own integration. Gambling ads come with their own rules and certification on both platforms, so check those before you plug anything in. Your ads account manager will not be charmed by "but the tracking was beautiful".
How do you keep a postback URL secure?
Treat it like a key to your stats. Anyone who has the full URL and a valid click ID could fire fake conversions into your tracker. Some trackers build a secret into the address itself: Keitaro's template includes a postback-key in the path (Keitaro).
| Risk | Protection |
|---|---|
| Someone copies your postback URL | Share it only through the program's dashboard or your account manager, never in public chats |
| One conversion reported several times | Pass a transaction ID, so a repeated call can't turn one deposit into five |
| Tracker and program disagree | Compare tracker conversions with the program's own stats every week |
That weekly check is dull. Dull is good here. Exciting tracking usually means something is on fire, and it's rarely the good kind of fire.
What should you do with the data once it works?
Use it to decide what to scale and what to switch off. With postbacks in place you can see earnings per click by campaign, placement and country, instead of by gut feeling and horoscope. Our guide on scaling only when EPC exceeds CPC walks through the maths.
| Signal | Use it for | Don't use it for |
|---|---|---|
| Registrations | Spotting broken landers fast | Deciding what to scale |
| First deposits | Comparing campaigns and placements | Final judgement on day one |
| Qualified players | Judging CPA profitability | Early optimisation, they arrive late |
The short version: judge campaigns on first deposits and qualified players, not registrations, and give delayed events time to arrive before you pull the plug. A campaign that looks dead at 10am may be very much alive by teatime, like most of us.
How we handle tracking at Seven Affiliates
Our dashboard gives you real-time tracking, so you can see how your traffic performs as it happens, and we offer CPA, RevShare and Hybrid deals with RevShare calculated on NGR. Whatever program you work with, ask your account manager which events are posted back for your deal before you launch.
That last part isn't a slogan, it's self-defence. A broken postback makes good traffic look bad, and nobody wants to end a promising partnership over a missing curly bracket (a curly bracket is a tiny thing to lose a deal over, and yet).
If your tracking is ready, apply to our iGaming affiliate program and tell us which tracker you use. If you're still setting it up, keep this page open in a tab, next to the one with the coffee order.
| Question | Our answer |
|---|---|
| Tracking | Real-time, in your dashboard |
| Deal types | CPA, RevShare and Hybrid |
| RevShare calculated on | NGR, 35% by default |
| Negative carryover | None |
FAQ
What is a postback URL in affiliate marketing?
It's a URL your tracker gives you, which the affiliate program's server calls when a conversion happens. It passes back your click ID, and often the payout and event type, so your tracker records the conversion without browser cookies.
What is S2S tracking?
S2S means server-to-server tracking. The program's server reports the conversion directly to your tracker's server through a postback, instead of relying on a pixel in the visitor's browser.
Is a postback better than a pixel?
For affiliate tracking, usually yes. Postbacks don't depend on cookies, ad blockers or browser privacy limits, and a transaction ID prevents duplicates. Pixels are easier to install but less reliable.
How do I test a postback URL?
Take a real click ID from your tracker, build the postback with it, and call it once to create a test conversion. Then check that the conversion appears against the right click in your tracker.
Why are my casino conversions delayed?
Some affiliate platforms send postbacks only after processing their data, and qualified-player events wait until the player meets the CPA criteria. A delay is normal, so check your program's timing before pausing a campaign.
Ready to track it properly? See how the Seven Affiliates iGaming affiliate program works, then apply here. Buying traffic? Read why you should scale only when EPC exceeds CPC next.