Postback
A postback is a behind-the-scenes message sent from the operator's servers to an affiliate tracking system to report that a tracked action — such as a registration or first deposit — has happened.
Definition
A postback is a server-to-server (S2S) HTTP request that an iGaming operator (or its platform) fires to an affiliate tracker or ad network when a previously tracked click results in a conversion event, passing back an identifier so the tracker can match the event to the original click. Because the call happens server-to-server rather than in the player's browser, it does not depend on client-side cookies, pixels or JavaScript, which makes it more resilient to ad-blockers, cookie restrictions and cross-domain tracking limits. The operator typically stores a click ID at the moment of the ad click and returns it in the postback URL (for example ?clickid=XYZ&event=ftd&payout=25), allowing the network to attribute the conversion, deduplicate it and calculate commission. Postbacks are widely used for CPA, hybrid and revenue-share affiliate models where accurate, tamper-resistant conversion reporting is essential.
Worked example
An affiliate runs a paid campaign and sends a player to an operator via a link containing a unique click ID: casino.example/?clickid=a1b2c3. The player registers and later makes a first deposit of GBP 40. When the deposit clears, the operator's server fires a postback to the tracker's endpoint — https://track.network.example/postback?clickid=a1b2c3&event=ftd&amount=40¤cy=GBP. The tracker matches clickid a1b2c3 to the original click, records a First-Time Deposit conversion, and credits the affiliate the agreed CPA of, say, GBP 30. No pixel loads in the player's browser, so the attribution survives even if the player cleared cookies or used an ad-blocker between the click and the deposit.
Why it matters
Postbacks are the plumbing that makes affiliate and performance-marketing payouts auditable, so anyone working in iGaming acquisition needs to understand them: they determine whether a conversion is attributed and paid, and misconfigured or duplicated postbacks are a common source of over- or under-reported commissions and reconciliation disputes. Because they run server-side, they also shape how operators handle data quality, fraud checks and — increasingly — player-privacy obligations, since the operator controls exactly what data is passed back and to whom. For analysts and compliance staff, understanding postbacks clarifies where marketing data originates and how affiliate spend maps to real player activity.
Related
Note: The core mechanism (server-to-server conversion callback keyed on a click ID) is a stable, vendor-neutral definition. Specifics vary by operator and tracking platform: parameter names (clickid vs click_id vs subid), which events trigger a postback (registration, FTD, qualifying deposit, revenue events), whether payout values are included, and deduplication/attribution windows are all configurable. Data passed in postbacks may include personal or financial identifiers, so what can be transmitted — and to which affiliates — is constrained by GDPR/UK GDPR and each jurisdiction's data-protection and advertising rules; verify against operator policy and applicable law.