Postback URL (S2S Tracking)

A postback URL, also called server-to-server or S2S tracking, is the address an advertiser's backend calls to tell an affiliate tracking platform that a conversion happened. Instead of a script firing in the visitor's browser, the advertiser's own server sends an HTTP request to that URL the moment a signup, trial, or payment is confirmed.

The term matters because browser-based tracking keeps losing ground to ad blockers, Safari's tracking prevention, and consent banners. In B2B SaaS, where programs pay recurring commissions on subscriptions, one missed conversion is not a single lost sale but months of misattributed revenue. Professional affiliates increasingly judge programs by whether tracking runs on postbacks.

How it works in B2B SaaS

The flow starts at the click. When a visitor clicks an affiliate link, the tracking platform generates a unique click ID and forwards the visitor to the advertiser's site, where that ID is stored, typically in a first-party cookie or a hidden field captured at signup.

When the conversion happens, the advertiser's server calls the postback URL with parameters appended:

• The click ID
• A unique transaction ID
• The event type
• The amount

The platform matches the click ID back to the original click, identifies the affiliate, and credits the commission.

In SaaS, conversion is rarely one event. Mature programs fire postbacks for trial starts, paid conversions, renewals, upgrades, and refunds, usually triggered by billing webhooks, so commissions track the whole subscription lifecycle.

A worked example

Picture a project management SaaS paying a 25% recurring commission. An affiliate's reader clicks their link, the platform issues click ID abc123, and the signup form quietly saves that ID onto the new trial account.

Two weeks later the trial converts to an $80 per month plan. The billing system fires the postback: track.example.com/pb?click_id=abc123&txn=inv_001&amount=80. The platform matches abc123 to the affiliate and credits $20.

Every monthly renewal triggers another postback carrying the same subscription reference, so the affiliate earns $20 each month the customer stays. If a refund is issued, a reversal postback claws the commission back. Across 1,000 clicks, 50 trials, and 10 paid accounts, that is $200 in new monthly recurring commissions, all reconciled automatically.

Typical ranges and benchmarks

Postbacks typically fire within seconds of the triggering event, so affiliate dashboards reflect conversions in near real time. The standard parameter set is a click ID, a transaction ID for deduplication, an event type, and an amount with currency.

Recurring SaaS commissions commonly run 20-30% of subscription revenue, which is exactly why S2S matters: those payments depend on renewal events a browser pixel can never see. Attribution windows in SaaS programs commonly span 30-90 days, enforced by comparing the click timestamp with the conversion timestamp.

Postback URL vs tracking pixel

A tracking pixel is a snippet on the confirmation page that fires from the visitor's browser. It is easy to install but fragile:

• Ad blockers strip it
• Consent tools suppress it
• Users close the tab before it loads
• A page refresh can fire it twice

A postback fires from server to server, so none of that applies. It only triggers when the backend confirms real revenue, and it can report renewals and refunds long after the browser session ended. The common misconception is that a pixel counts as server-side tracking because it hits a server. It does not; what matters is where the request originates.

How it shows up in affiliate and partner programs

Tracking platforms hand advertisers a postback template with placeholder macros, and a developer wires it into the billing system's webhook handler, often a few hours of work. Networks and sub-affiliate setups chain postbacks: the advertiser notifies the network, which forwards the conversion to the media buyer's own tracker.

For affiliates, a program advertising S2S tracking signals that recurring commissions, refund handling, and reporting will be accurate. Many experienced media buyers will not send paid traffic to a program without a working postback.

Common mistakes

The classic failure is losing the click ID between click and conversion. If the signup flow never captures it, the postback fires with an empty click_id and the conversion cannot be attributed to anyone.

Running a pixel and a postback simultaneously without deduplication double-counts conversions and double-pays commissions. Deduplicate on transaction ID and pick one source of truth.

Two more traps: firing postbacks only for the first payment, which silently breaks recurring commissions and clawbacks, and passing personal data such as email addresses in postback parameters. Send pseudonymous IDs only, and always send a test postback before launch.

Frequently asked questions

Is a postback URL the same as a webhook?

They share the same mechanics: one server calling another over HTTP when an event occurs. Webhook is the general-purpose term, while postback is the affiliate-specific use where the payload carries a click ID and conversion details for attribution. Every postback is a webhook, but not every webhook is a postback.

Do postback URLs work without cookies?

The postback call itself needs no cookies because it never touches the browser. You still have to carry the click ID from the click to the conversion, though, usually via a first-party cookie, a URL parameter captured at signup, or a field on the account record. Cookie restrictions affect click ID storage, not the postback.

What parameters should a postback include?

At minimum the click ID and a unique transaction ID so duplicate calls can be ignored. Most SaaS programs also send the event type, amount, and currency so the platform can compute commissions and process refunds correctly. Keep personal data out of the URL entirely.