What is a postback URL?
A postback URL is an address on your server that a tracking system calls when a conversion happens. The request carries details such as the user's ID and the amount, so your server can record the conversion or credit the user without anything running in the browser.
Updated
On this page
You give the tracking system a URL with placeholders, called macros. When a conversion happens, it fills them in and sends the request.
Example: Pebble Rewards saves this URL.
https://api.pebble.example/afos?user={sub_id}&txn={transaction_id}&reward={user_payout}Player u_48213 installs Harbor Blocks, and Pebble Rewards’ server receives this request.
https://api.pebble.example/afos?user=u_48213&txn=act_5Kp2x9&reward=1.5It reads user to know whom to credit and stores txn so the same conversion never credits twice.
| Postback | Pixel | |
|---|---|---|
| Where it fires | From one server to another | In the user’s browser |
| Needs a cookie | No, it carries an ID from the click | Often |
| Ad blockers | Can’t reach it | Can stop it |
| Works inside an app | Yes | Not without a browser |
| Can take a conversion back | Yes, with a second request | Not on its own |
A postback is a kind of webhook. The difference is mostly habit: a webhook usually POSTs a JSON body to a fixed address, and a postback is usually a GET whose query string you shape yourself.
We send your server a signed GET for every credit and every reversal. Add one URL for every offer on Postbacks, then use Send test postback before any traffic. Each request carries a verifier, an HMAC-SHA256 of the URL keyed with your ps_ secret: Verify a signed postback with HMAC-SHA256. If nothing shows up, start with Postback not firing or never arrives.
Questions
Is a postback the same as a callback?
Yes, in everyday use. People also say S2S postback or conversion callback. All of them mean one server telling another that a conversion happened.
Why do postbacks need a signature?
Your postback URL is just an address, so anyone who finds it could call it and ask for a credit. A signature made with a shared secret lets your server check that the request is real before it credits anyone.
What should my server answer?
Store the request, then answer with a 2xx status. Keep the work behind that answer short, because the sender can time out and treat the delivery as failed.