S2S Postback Tracking for Affiliate Programs

S2S postback tracking records an affiliate conversion with a server-to-server request instead of a browser pixel. When a visitor clicks an affiliate link, the platform issues a click ID. Your backend stores it and, once the sign-up, sale or deposit is confirmed, calls a postback URL with that click ID and the event details. The platform then credits the right affiliate and calculates the commission.

MassPartner runs this flow for brands that operate their own affiliate program. Postbacks are authenticated with a per-brand secret or an HMAC signature, every click carries a fraud score, and each campaign decides which conversions are approved automatically. If the concept is new to you, start with our explainer on what a postback URL is or the short definitions of a postback URL and S2S tracking.

Why server-to-server tracking for affiliate conversions#

A pixel fires from the visitor's browser, so it inherits every browser restriction. Safari, for example, blocks third-party cookies by default and deletes a site's script-writable storage after seven days of browser use without interaction with that site (WebKit). Ad blockers and consent tools remove more signals.

A postback only needs the click ID your server already saved. That makes it the dependable choice for events that never touch a browser: a deposit confirmed by a payment provider's webhook, a subscription renewal, or a lead your sales team qualifies days later.

MassPartner supports all three entry points: tracking links with redirect, a JavaScript tracking script for your site, and S2S postbacks. Most brands use the script to capture the click ID on landing and the postback to report the conversion.

How S2S postback tracking works on MassPartner#

1. Click. A visitor opens an affiliate's tracking link. MassPartner logs the click with the affiliate, campaign and up to five sub IDs, runs fraud checks, applies the campaign's country rules and issues a click ID.
2. Landing. The visitor reaches your site. The tracking script stores the click ID in a first-party cookie named mp_click, or you read it from the landing URL.
3. Storage. Your backend saves the click ID on the user or order record.
4. Conversion. When the registration, sale or deposit is committed, your server calls your brand's postback URL.
5. Attribution. MassPartner resolves the campaign and affiliate from the click ID, so you never send them, then calculates the commission and applies the campaign's approval rules.

A typical postback request (example values):

https://masspartner.com/api/postback/YOUR_BRAND_ID?click_id=8f3c2a91e4b74d0a9c1e5f7b2d6a3c40&event=sale&amount=120.00&currency=USD&order_id=ORD-10442&user_id=CUST-881&token=YOUR_POSTBACK_SECRET

Requests can be sent as GET or POST. The endpoint answers with JSON, and a failed request returns HTTP 400 with the reason, such as Click not found or Campaign is not active, so your logs show exactly what to fix. Full parameter lists are in the platform documentation.

Postback authentication: secret token or HMAC signature#

A postback URL is effectively an instruction to pay someone, so it needs a credential. Every brand has its own postback secret, shown masked on the tracking page with reveal, copy and regenerate actions. You can authenticate in two ways:

• Token. Add token=YOUR_POSTBACK_SECRET to the request. It is the quickest option and works with any backend or tracker that can call a URL.
• HMAC signature. Send an X-MP-Signature header with a Unix timestamp and an HMAC-SHA256 of that timestamp and the sorted query parameters, keyed with your secret. The secret never travels with the request, tampered parameters fail verification, and signatures older than five minutes are rejected. HMAC is the keyed-hash construction defined in RFC 2104.

X-MP-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, "<t>.<canonical query>")>

The exact canonicalization rules are documented in the API reference. Two modes decide what happens to requests without valid credentials:

Existing integrations run in grace mode, so nothing breaks while you add the token. Switch to enforce once your logs show only authenticated requests, and regenerate the secret if it ever appears in a screenshot or support ticket. Send postbacks over HTTPS only, and pass customers as internal or hashed IDs, never as an email address in the query string.

What happens after a postback arrives#

Authentication is the first check, not the last. Before a commission reaches a payout, each conversion passes through the campaign's rules:

• Commission calculation. Fixed amounts for CPA, CPL, CPC and CPI, a percentage of the amount you send for CPS and RevShare, or a hybrid of both. RevShare is calculated on the revenue amount in each postback, so any net-revenue logic stays in your backend.
• Payout model. Pay on the first purchase only, on all purchases, on recurring payments for a set number of months, or for the customer's lifetime with an optional end date.
• Deduplication. A registration is recorded once per click, and "first purchase only" campaigns check both the click and your user_id before paying again.
• Caps. Daily, monthly and total conversion caps record conversions past the limit without a commission.
• Fraud score. Conversions from high-risk clicks are not approved automatically, whatever the campaign setting.
• Approval mode. Auto, manual, or delayed by a set number of days, configured separately for registrations and for sales or deposits.

So a postback can succeed while the commission still shows as pending, which is usually what you want when refunds and chargebacks arrive weeks after the sale. Our guide to affiliate fraud detection covers the patterns these rules are designed to catch.

Forward conversions to affiliates' own trackers#

Media buyers run their own trackers and want conversions reported back. In the affiliate dashboard, each partner can configure callback URLs with placeholders such as {$clickid}, {$sub1}, {$commission} and {$status}, and choose which events trigger them. Tracker-specific formats for Voluum, RedTrack, Keitaro and Binom are in our guide to sending affiliate postbacks to a tracker.

Set up S2S postback tracking in five steps#

1. Create a campaign with its commission type, cookie duration (30 days by default) and approval mode.
2. Capture the click ID with the tracking script or from the landing URL, and store it server-side on the user or order.
3. Copy your postback URL and secret from the tracking page in the brand dashboard.
4. Fire postbacks from your backend after each event is committed, with click_id, event, amount, currency, order_id and user_id. Use a short timeout and log every response.
5. Test and enforce. Run the installation tester, complete a conversion from a real click, confirm the event and amount in your reports, then switch authentication to enforce mode.

What to look for in postback tracking software#

Comparing platforms? See MassPartner as an Everflow alternative or a Scaleo alternative, or read the overview of our affiliate tracking software.

Pricing#

Tracking links, the JavaScript tracking script and S2S postbacks are included on every plan. Starter costs $79 a month with 100K tracking requests, Professional $149 with 1M, Business $299 with 5M plus API access and a custom domain, and Enterprise starts from $699. Every plan starts with a 7-day free trial; compare the details on the pricing page.