> AffiliateOS Help Center. Index of every article for AI tools: https://www.affiliateos.ai/help/llms.txt

# Postback not firing or never arrives

Troubleshooting · For publishers, networks · Updated 30 October 2026
Web version: https://www.affiliateos.ai/help/troubleshooting/postback-never-arrives

Most often there's no postback secret. We never send a publisher postback unsigned, so the conversion counts in your report and nothing reaches your server. Open **Flight Recorder**, find the conversion, and its delivery status names the fix.

## What you see

| What you see | What it means | What to do |
|---|---|---|
| **Postbacks** says "No postback secret, so none of your postbacks are being sent" | You have no secret, so nothing is sent | Create one (first check below) |
| Publishers: **Delivery** reads `failed`, with an **HTTP status** | Your server answered with an error | Fix your endpoint, then ask us to resend |
| Publishers: **Delivery** reads `failed`, with no **HTTP status** | We couldn't reach your server | Check the URL, DNS and certificate |
| **Delivery** reads `skipped_no_url` | No postback row matched this conversion | Add a conversion row |
| **Delivery** reads `sent` | Your server answered with a 2xx | Search your own logs for the `action_id` |
| No row for the user or the offer | No conversion was reported to us | See [An install wasn't tracked](https://www.affiliateos.ai/help/troubleshooting/install-not-tracked) |

To get there: publishers open **Reporting**, then **Flight Recorder**, and filter by **Sub ID** (your user's ID) or **Action ID**. For a Hosted Offerwall user, find the conversion in **Conversions** first, where the **Sub ID** column shows your `uid`, and paste its **Action ID** here. Choose a row to see **Your postback delivery**. Networks open **Reporting**, then **Flight Recorder**, and choose a row to see **Network Delivery Response**: **Status**, **HTTP**, **Error**. On a network delivery that failed, **HTTP** stays empty, so read **Error** for the reason.

## Checks, most likely first

### No postback secret (publishers)

**How to confirm:** **Postbacks** shows the warning above your rows. In [Flight Recorder](https://www.affiliateos.ai/glossary#flight-recorder), the conversion's **Error** reads "No active partner postback secret configured; postback not sent".

**Fix:** Choose **Create postback secret** and copy it at once: it starts with `ps_` and is shown once. Put it in your server's verification, then use **Send test postback** on a saved row. Conversions from before the secret existed aren't sent on their own; send us their action IDs and we'll tell you which we can send again.

### No row matches the conversion

**How to confirm:** **Delivery** reads `skipped_no_url`.

**Fix:** Open **Postbacks** and look at both tabs, **Conversions** and **Events**. Event rows are only used for later steps, so if your only rows are event rows, installs and first steps go nowhere. Add a conversion row with **Postback Level** set to global. Inactive rows are skipped too. Once you save any row, the account-level fallback URL stops being used. How rows are picked: [global or offer-specific postbacks](https://www.affiliateos.ai/help/postbacks/global-or-offer-specific).

### Your server answered with an error

**How to confirm:** **Delivery** reads `failed` with an **HTTP status**, and **Error** gives the reason. **Copy request** copies the masked URL we called, with the parameters in it, so you can replay it.

**Fix:** A 401 or 403 usually means your signature check failed: verify the URL exactly as you received it, with your current secret. Rotating a secret stops the old one at once, so a server still holding the old one rejects everything. A 404 means the path changed. Publisher postbacks that got a 5xx or 429 were retried a few times within seconds, then stopped; other 4xx answers aren't retried. Network postbacks are sent once. Fix the endpoint and answer 200. Publishers: send us the action IDs: our team can send failed credits from the Offer API and links again, under the same `action_id`, so your dedupe holds. How to verify: [Verify a signed postback with HMAC-SHA256](https://www.affiliateos.ai/help/postbacks/verify-postback-secret).

### We couldn't reach your server

**How to confirm:** **Delivery** reads `failed` with no **HTTP status**, and **Error** names a timeout or a refused connection.

**Fix:** The URL must start with `http://` or `https://` and be reachable from the internet. Check its DNS, your firewall and your certificate, then **Send test postback**. A passing test proves your URL answers; it doesn't prove live conversions route there.

### We sent it, and your server didn't credit it

**How to confirm:** **Delivery** reads `sent` and **HTTP status** (networks: **HTTP**) shows a 2xx.

**Fix:** Search your logs for the `action_id`. The usual causes: your code dedupes on `action_id` alone, so it drops a [reversal](https://www.affiliateos.ai/glossary#reversal) of a step you already credited; it looks the user up by something other than `sub_id` (on the Hosted Offerwall, `sub_id` is the `uid` you launched with); or it answers 200 before the crediting fails.

### Networks: your server stopped trusting the signature

**How to confirm:** Your server rejects our postbacks with a 401, and someone recently generated or revoked the **Webhook Secret** under **Workspace settings**.

**Fix:** Generating a secret replaces the old one at once. Revoking it means postbacks arrive with no `verifier`. Put the current secret on your server, or stop requiring one, then use **Test Postback**.

> **Publishers: a reversal follows its credit.** We send a reversal postback only for a credit whose own postback reached you. If a credit failed and was never resent, its reversal isn't sent either, so fix failed deliveries before you reconcile balances.

## Send us this

- The email you sign in with, and your role: publisher or network.
- The `action_id` from **Flight Recorder**, or the user's **Sub ID** and the offer ID.
- When the conversion happened, with your time zone.
- What **Your postback delivery** (networks: **Network Delivery Response**) shows: the status, the HTTP status and **Error**.
- The masked URL from **Copy request** (networks: **Masked URL**). Never send your secret.