S2S Postback Setup Guide for Media Buyers 2026
Table Of Contents
- What Changed in S2S Postback in 2026
- How S2S Postback Works
- Step 1 β Get Your Tracker Postback URL
- Step 2 β Configure the Postback in Your CPA Network
- Step 3 β Pass Click ID from Tracker to Network
- Step 4 β Connect to Facebook CAPI (Dual Postback)
- Step 5 β Test Your Postback Before Spending
- Advanced: Postback Security
- Quick Start Checklist
- What to Read Next
TL;DR: Server-to-server (S2S) postback is how your tracker receives conversion data from CPA networks without relying on cookies or pixels. A correctly configured postback is the difference between optimizing on real data and guessing. Setup takes 20β45 minutes depending on your tracker. If you need verified ad accounts that work with CAPI and S2S tracking β check Facebook accounts for advertising β accounts with Business Manager access for full server-side integration.
S2S postback is the backbone of every performance marketing operation. It replaces client-side pixel tracking with a direct server-to-server signal β meaning conversions register even when users block cookies, use browsers with ITP, or turn off JavaScript. According to Voluum's 2025 data, mobile traffic represents 78% of affiliate volume, and iOS Safari's cookie restrictions make S2S postback the only reliable tracking method for iOS users.
| β Works for you if | β Not for you if |
|---|---|
| You run CPA/CPL offers via affiliate networks | You only run direct-response ads on platform |
| You use a tracker (Keitaro, Binom, BeMob) | You have no tracker and no network integration |
| You need conversion data in your tracker | You rely purely on platform-reported conversions |
| You run multi-source traffic | Your single-platform setup has native tracking |
What Changed in S2S Postback in 2026
- Postback URL encryption became standard. Most top CPA networks (Leadbit, Dr.Cash, Alfaleads) now require HTTPS postback URLs β HTTP endpoints are rejected outright.
- Click ID parameter standardization. Networks migrated toward
{clickid}and{click_id}macros; legacy{subid}parameters still work but generate deprecation warnings in some networks. - Duplicate postback deduplication. Platforms like Meta now deduplicate server-side events against pixel events using the Event ID field β missing this creates double-counting in attribution.
- CAPI + S2S hybrid flows are now default. The professional setup in 2026 fires both a tracker postback (for optimization data) AND a CAPI event to the ad platform (for bidding optimization) β from the same conversion signal.
- IP and User-Agent forwarding required. Facebook's CAPI now requires hashed client IP and User-Agent in server events for accurate match scoring; trackers that don't forward these fields see 20β30% lower Event Match Quality.
Need accounts ready for this workflow? Browse verified Google Ads accounts with high spend limits β pre-warmed, no learning phase delays.
How S2S Postback Works
The postback flow has 5 steps:
- User clicks your ad β Tracker receives the click, assigns a unique Click ID (e.g.,
abc123xyz) - Tracker appends Click ID to the offer URL:
https://offer.com/landing?clickid=abc123xyz - CPA network stores Click ID in its system along with the user session
- User converts (makes a purchase, submits a lead, deposits)
- CPA network fires postback to your tracker:
https://yourtracker.com/postback?clickid=abc123xyz&status=approved&payout=12.50 - Tracker records conversion, attributes it to the original ad/campaign/placement
This entire flow happens server-to-server β no browser involvement after step 1. That's why it works regardless of browser privacy settings.
Related: Conversion Tracking and Postback: How to Integrate Your Tracker with Twitter/X Ads
Step 1 β Get Your Tracker Postback URL
Every tracker generates a system postback URL. This is the endpoint you give to CPA networks.
Keitaro: Go to Campaigns β select campaign β Tracking URLs β copy the S2S Postback URL. It looks like: https://yourdomain.com/postback?clickid={clickid}&status={status}&payout={payout}
BeMob: Settings β S2S Postback β copy Global Postback URL. https://yourdomain.com/postback?cid={click_id}&payout={payout}&status={status}
Related: How to Set Up Postback and Conversion Tracking in 2026: S2S Integration Guide
Binom: Settings β Postbacks β copy Binom's postback endpoint, then configure per-campaign.
Note the parameter names β they differ by tracker. Most common: clickid, cid, click_id, subid.
Step 2 β Configure the Postback in Your CPA Network
Log into your CPA network's affiliate dashboard. Every major network has a "Postback URL" or "Tracking" section in offer settings or global settings.
Steps (universal): 1. Go to Offer Settings β Tracking β Postback URL 2. Paste your tracker's postback URL 3. Map the network's conversion macros to your tracker's parameters: - Network's {transaction_id} β your tracker's {clickid} field - Network's {payout} β your tracker's {payout} field - Network's {status} (approved/pending/rejected) β your tracker's {status} field 4. Save and test using the network's Test Postback button
Common macro naming across networks:
Related: Postback and S2S (CAPI) in Facebook Tracking: Architecture, Deduplication, and Money-Based Goals
| Parameter | Leadbit | Dr.Cash | Alfaleads | Zeydoo |
|---|---|---|---|---|
| Click ID | {clickid} | {click_id} | {sub_id} | {clickid} |
| Payout | {payout} | {price} | {payout} | {payout} |
| Status | {status} | {status} | {status} | {lead_status} |
Always verify macro names against the network's documentation β using the wrong macro means the postback fires but sends empty values.
β οΈ Warning: Never use a global postback URL for all offers in all campaigns. Configure postback per campaign (or at minimum per traffic source). A global postback with wrong campaign attribution will mix conversion data across campaigns and make optimization impossible.
Step 3 β Pass Click ID from Tracker to Network
The Click ID needs to travel from your tracker, through the landing page, and into the CPA network's system. This is where most buyers make mistakes.
The flow: 1. Tracker appends ?clickid={clickid} to the offer URL (configured in campaign settings) 2. If there's a landing page in between, the landing page must pass through the click ID to the offer URL 3. Offer URL must accept the click ID parameter and store it
For direct linking (no landing page): - Set offer URL in tracker to: https://offer.example.com/?clickid={clickid} - The {clickid} placeholder gets replaced with the actual ID at click time
For landing page flows: - Tracker sends click to LP: https://yourlp.com/?clickid=abc123 - LP button/form must forward this: https://offer.example.com/?clickid={get("clickid")} - Most LP builders (Landingi, Unbounce) have JS snippets to auto-forward URL parameters
β οΈ Warning: If your landing page doesn't pass through the click ID, every conversion fires the postback with an empty
{clickid}parameter. The tracker receives the conversion but cannot attribute it to any campaign, source, or ad. You'll see conversions in your CPA network but zeros in your tracker β a silent data leak.
Step 4 β Connect to Facebook CAPI (Dual Postback)
Modern setups fire two signals from a single conversion: 1. Postback to tracker (for campaign-level attribution) 2. CAPI event to Facebook (for bid optimization and reporting)
To avoid double-counting in Facebook reports, you must deduplicate using Event ID:
In your tracker (Keitaro example): 1. Enable CAPI integration: Settings β Integrations β Facebook CAPI 2. Enter your Pixel ID and Access Token (from Facebook Events Manager β Settings β Conversions API) 3. Map event: Purchase/Lead β trigger on conversion postback 4. Set Event ID = {clickid} (this deduplicates against any pixel event with the same ID) 5. Forward client IP and User-Agent from the original click β Keitaro does this automatically from stored click data
Without deduplication, your Facebook reports will count each conversion twice β once from pixel and once from CAPI β inflating ROAS by 2x. This breaks your bidding optimization and makes performance look better than it is until you realize the issue.
Case: Media buyer, Facebook campaigns, nutra offer, $400/day. Problem: ROAS appeared at 3.8x in Ads Manager but CPA network showed 40% fewer approved conversions. Investigation revealed postback was firing but click ID was missing β LP was not forwarding the
?clickid=parameter. Fix: Added URL parameter passthrough to LP using a 2-line JavaScript snippet. Click IDs started passing correctly. Result: Tracker and Ads Manager data aligned within 5%. Identified 2 ad sets that appeared profitable but were actually losing money β paused them. ROAS stabilized at 2.6x real.
Step 5 β Test Your Postback Before Spending
Never launch a campaign without testing the full click β conversion β postback flow.
Testing checklist: 1. Test click: Click your tracking link, verify the click appears in tracker with a Click ID 2. Test landing page passthrough: Check the URL on the offer page β does it contain your click ID? 3. Fire test postback: In your CPA network, use the "Test Postback" button with the click ID from step 1 4. Verify in tracker: The conversion should appear in tracker stats attributed to the correct campaign 5. Verify CAPI receipt: In Facebook Events Manager β Test Events β confirm the server event arrived with the correct event ID
Common failure modes to check:
| Symptom | Likely Cause |
|---|---|
| Conversions in network, zeros in tracker | Click ID not passing through LP |
| Postback 404 error | Tracking domain SSL issue or wrong endpoint URL |
| Click IDs arriving empty | Wrong macro name in postback URL |
| Double conversions in Facebook | Missing Event ID deduplication |
| Conversion fires for wrong campaign | Using global postback instead of campaign-specific |
Advanced: Postback Security
If your postback URL is discovered and hit with fake conversions, your tracker stats get corrupted. Two protection methods:
Method 1: Postback password/token Most trackers support a postback secret. Example: https://yourdomain.com/postback?clickid={clickid}&payout={payout}&token=YOUR_SECRET_HERE Configure this token in your tracker's postback settings. Any postback without the correct token is rejected.
Method 2: IP whitelist In tracker settings, whitelist only the IPs of your CPA networks. All other IPs are blocked from firing postbacks. Most networks publish their postback sender IP ranges in their documentation.
Need reliable ad accounts for your S2S setup? Browse TikTok Ads accounts β accounts with BC access for multi-campaign postback tracking.
Quick Start Checklist
- [ ] Get tracker postback URL (from Keitaro/BeMob/Binom postback settings)
- [ ] Configure postback in CPA network β map Click ID, Payout, Status macros
- [ ] Set offer URL in tracker with
?clickid={clickid}appended - [ ] If using landing page β add click ID passthrough JavaScript
- [ ] Test: fire a test postback and verify it appears in tracker stats
- [ ] Configure CAPI integration with Event ID deduplication
- [ ] Add postback secret token for security
- [ ] Verify postback delivery rate is 98%+ in first 24 hours of live traffic
What to Read Next
What To Do If Your Google Ads Campaigns Are Losing Money: A Step-by-Step Recovery Plan
Updated: April 2026 TL;DR: Google Ads campaigns lose money when cost per acquisition exceeds revenue β and it's happening more often...
How to Build a Lookalike Audience in Twitter Ads
Updated: April 2026 TL;DR: Twitter's lookalike audiences (called "Lookalike expansion" and "Follower lookalikes") let you scale campaigns by finding users who...
Pricing in the Niche β How the Price for an Account, Inventory, or Service Is Formed
Updated: April 2026 TL;DR: Prices for game accounts, inventory, and services are shaped by four forces: supply scarcity, demand spikes, seasonal...
