What Is a Postback URL? How Server-to-Server Conversion Tracking Works, With a Template

A postback URL is an address one server requests to report a conversion to another system, without going through the buyer's browser. It carries the click ID the tracker issued when the visitor clicked, usually with the payout, so the receiving system can credit that click without relying on a cookie.

Postbacks are how affiliate networks and trackers hand a click ID back after a sale. Ad platforms do the same job with their own click IDs and conversion APIs, which our explainer on fbclid and Meta's _fbc cookie covers. This post explains how a postback works, the parameters it carries, a template you can adapt, how it differs from a tracking pixel and from a Conversions API call, and when a Shopify store needs one. Tracker details come from Voluum's and RedTrack's own documentation, checked October 24, 2026.

What is a postback URL?

It's a URL with placeholders that a server requests when a conversion happens. Voluum's documentation describes the S2S postback as a server-to-server method of tracking conversions, where a server on the offer owner's side sends conversion data back to the platform the visitor came from. Its traffic source postback guide adds that the request can be an HTTP GET or POST.

You'll also see it called an S2S postback or server-to-server tracking. The idea is the same: the system that saw the sale tells the system that saw the click, using a click ID both of them recorded. RedTrack's conversion tracking guide calls S2S the most common method with affiliate networks, and notes that the network, shop or CRM has to support postbacks.

Three parties are usually involved:

• The traffic source: the ad network or platform that sent the visitor.
• The tracker: a tool such as Voluum or RedTrack that sits between the ad and the offer and records each click.
• The offer owner or affiliate network: where the sale or lead actually happens.

---

How does postback tracking work?

1. The click. A visitor clicks your ad. The tracker records the visit and generates a unique click ID.
2. The handoff. The tracker sends the visitor to the offer with the click ID in a parameter the network supports. Voluum's example is https://www.offer_link.com?s2={clickid}, where s2 is the network's parameter and {clickid} is filled with Voluum's click ID.
3. The stored ID. The affiliate network saves that click ID against the visit.
4. The conversion. When the visitor buys or signs up, the network's server requests your postback URL, with its own token replaced by the stored click ID and, if you set it up, the payout.
5. The match. The tracker looks up the click ID, records the conversion against that visit, and reports it by campaign, lander, offer, device and the rest.
6. The second leg (optional). The tracker fires its own postback to the traffic source, using the click ID the traffic source passed in at step 1, so the ad network can optimize too.

Voluum's documentation separates the two legs. The postback URL goes into the affiliate network's platform so the network can pass conversions to Voluum. The traffic source postback URL goes into Voluum's traffic source template so Voluum can pass conversions to the traffic source. In Voluum, the traffic source's click ID is stored as an external ID and sent back with the {externalid} token.

---

What does a postback URL carry?

At minimum, the click ID. Everything else is optional and depends on what both sides support.

Sources: Voluum's parameters in postback URLs, RedTrack's payout and revenue sync and conversion types guides, checked October 24, 2026.

The values come from macros, also called tokens, and every network writes them differently. RedTrack's examples show Affise filling the click ID with {sub1} and the payout with {sum}, and CAKE using #s2# and #price#. Voluum warns that the parameters and placeholders you use must be ones your network supports. Put the wrong token in the postback and the network fires it without a usable click ID, so the tracker can't match the sale.

---

What does a postback URL template look like?

Here's the full round trip, using Voluum's parameter names and the CAKE-style tokens both trackers show in their docs. The domains are placeholders.

1. Offer URL you send traffic to (tracker fills {clickid}):
   https://offer.example.com/?s2={clickid}

2. Postback URL you give the network (network fills #s2# and #price#):
   https://track.example.com/postback?cid=#s2#&payout=#price#

3. What the network's server requests after a sale:
   https://track.example.com/postback?cid=8f3c2a91d7e44b0b&payout=42.00

4. Traffic source postback (tracker fills {externalid} and {payout}):
   https://ads.example-network.com/conversion?click_id={externalid}&payout={payout}

In RedTrack, line 2 uses its own names, for example https://track.example.com/postback?clickid=#s2#&sum=#price#. Line 4 follows whatever the traffic source's documentation asks for; click_id there is only an example.

How do you test a postback?

Click your own campaign link to get a real click ID, paste it into the postback URL by hand with a test payout, request it in a browser, and check that the conversion appears in the tracker against that click. Then check the network's postback log for the live version. Voluum's glossary also notes that every link in the chain should use the same protocol, HTTP or HTTPS.

---

How is a postback different from a tracking pixel?

A pixel reports the conversion from the buyer's browser; a postback reports it from the network's server.

Voluum's conversion pixel guide explains the trade-off. A pixel is cookie-based: the click ID is stored in a cookie at the click, and a pixel on the thank-you page reads it and reports the conversion. That works even when the click ID wasn't passed to the offer, but if the visitor's browser blocks cookies, the pixel doesn't work. Voluum offers pixels for networks that don't support S2S postbacks. RedTrack's guide adds two more weaknesses: a buyer who refreshes the thank-you page can fire the pixel twice, and Safari's tracking protection makes cookie-based tracking harder. Its S2S postbacks don't rely on cookies, so they work when a visitor blocks them.

Postbacks are reliable when the network fires them correctly and blind when it doesn't: if the network never sends the request, the tracker has no other way to learn about the sale.

How is a postback different from a Conversions API call?

Both are server to server, but they talk to different systems and carry different data. A postback tells a tracker or an ad network "click X converted, worth Y". A Conversions API call tells an ad platform such as Meta, TikTok or Google who converted and what they did, so the platform can match the event to a person even when there's no click ID.

TikTok's Events API setup guide shows the difference: a POST to TikTok's API with an access token header and a JSON body holding the event name, event time, an event_id, the click ID if there is one, SHA-256 hashed email, phone and external ID, the IP address and user agent, and the order value. Our ttclid guide walks through those fields.

Deduplication works differently too. Meta, for example, keeps one copy when events with the same event_id and event name reach the same pixel within 48 hours, per its deduplication guide; our guide to Meta event ID deduplication explains it. A postback has nothing to deduplicate against unless both sides agree on a transaction ID.

Trackers often bridge the two. RedTrack's Conversion API page says that when you don't own the offer page, conversions come in by postback from the network and are forwarded server-side to the ad platform, and Voluum's pricing page calls the same idea a "Conversion API postback for major traffic platforms". Our RedTrack vs Voluum comparison covers which plans include it.

---

Do Shopify stores need postback URLs?

Usually not. A postback exists because the sale happens on someone else's server: the affiliate network or the offer owner sees it, and you don't. When you sell your own products on Shopify, the order happens in your checkout, so you already have it. The job is to send it, with the click ID and customer details, to the ad platforms that bought the traffic, and that's a Conversions API job.

You'd still use postbacks if you:

• Run an affiliate program through a network that reports sales by postback.
• Promote other merchants' offers as an affiliate or media buyer.
• Buy native, push or pop traffic from networks that optimize on S2S postbacks rather than ad platform APIs.

For those jobs you want a campaign tracker. Our RedTrack review and Voluum vs Hyros comparison cover tools built around postbacks, redirects and lander rotation.

To be clear about where we fit: Upstack sends Shopify events to the ad platforms' conversion APIs, including the Meta Conversions API, Google Ads and the TikTok Events API. It isn't an affiliate postback tracker. It doesn't issue click IDs to affiliate networks, receive their postbacks or rotate landers. It does accept server-to-server events from your own stack, such as a custom checkout, over webhook or direct post.

---

Frequently asked questions

Is a postback URL the same as a webhook?

They're close relatives. Both are server-to-server HTTP requests fired when something happens. A postback is a URL you hand to a network, with the data packed into query parameters through the network's tokens; a webhook usually posts a structured body to an endpoint you control.

Why aren't my postback conversions showing up?

Usually because the click ID never made the round trip: the offer URL doesn't pass it in the parameter the network expects, or the postback uses a token the network doesn't fill. Check that the parameter in the offer URL matches the token in the postback, test with a real click ID, and look at the network's postback log for errors.

Can I send a postback to Meta or Google Ads?

Not as a plain URL. Meta takes server events through the Conversions API, TikTok through the Events API, and Google Ads through uploaded click conversions, which Google now routes through its Data Manager API. Trackers such as RedTrack and Voluum translate the postbacks they receive into those API calls.

What's the difference between a postback URL and a traffic source postback URL?

Direction. In Voluum's terms, the postback URL goes into the affiliate network's platform so the network can report conversions to the tracker, and the traffic source postback URL goes into the tracker so it can report conversions on to the ad network that sent the visitor, using that network's own click ID.

---

Key takeaways

• A postback URL is a server-to-server request that reports a conversion with the click ID the tracker issued, plus optional payout, transaction ID and conversion type.
• It has two common legs: network to tracker, and tracker to traffic source.
• Parameter names and tokens differ by tracker and network; a mismatch is the usual cause of missing conversions.
• A pixel reports from the browser and depends on cookies; a postback reports from a server and depends on the network firing it.
• A Conversions API call sends richer, hashed customer data to an ad platform and deduplicates on an event_id; Shopify stores selling their own products need that more than postbacks.

See how Upstack Signal sends Shopify orders to Meta, Google and TikTok through their conversion APIs.