Pixel & Platform IntegrationsTutorialIntermediate

Affiliate server-to-server postbacks: one engine, fourteen networks, and what each one signs

How affiliate S2S postbacks work end to end — capturing the network click id, storing it first-party, firing the postback on the verified purchase, handling reversals — with the specifics of Awin, CJ, Impact, TradeTracker, Tradedoubler, Partnerize, Rakuten, Webgains, Digistore24, Adcell, Belboon, TUNE and Everflow.

By
Track editorial team
Published
Last reviewed
Reading time
3 min read

Key takeaways

  • Every network follows the same engine: capture the click id with marketing consent, confirm the purchase from a trusted source, fire the signed postback from the server, reconcile reversals.
  • Fourteen presets — Awin, CJ, Impact, TradeTracker, Tradedoubler, Partnerize, Rakuten, Webgains, Digistore24, Adcell, Belboon, TUNE, Everflow and a custom template — differ in method, click id, signature and reversal handling.
  • Inbound postbacks such as Digistore24's IPN are verified per site and turned into purchase or refund events; unverified requests are rejected and counted in destination health.
  • One postback per order reference plus the voucher code on the postback prevents paying two publishers for the same sale.

The common engine

  1. Capture. The visitor lands with the network's click parameter (awc, cjevent, irclickid, tduid, clickref …). With marketing consent the SDK stores it first-party under the network's name, for the programme's cookie window (usually 30 days).
  2. Confirm. The purchase is confirmed by a trusted source — a verified shop webhook, the order system, or a browser purchase that the policy marks as trusted enough for the network.
  3. Postback. The worker renders the network's postback template with the click id, order reference, amount, currency, optional voucher code and item breakdown, signs it where required, and sends it from the server.
  4. Reconcile. Reversals (refunds, cancellations) fire the network's reversal or adjustment call with the same order reference.

Because the click id is stored first-party and the postback leaves from the server, blocked pixels and expired third-party cookies do not lose commissions — and the network only ever receives real, confirmed orders.

Per-network specifics

NetworkMethodClick idAuth / signatureReversal
AwinGET sread.phpawccksnone; testmode flagvia Awin API / manual validation
CJGET emjcd.com/ucjeventSIGNATURE (enterprise key)corrections via API
ImpactPOST ConversionsirclickidClickIdBasic (account SID + auth token)Conversion modifications
TradeTrackerGET ts.tradetracker.net/?tt=…ttref/ttcampaign id + product idpending status
TradedoublerGET tbs.tradedoubler.com/reporttduidchecksum=v04 + md5(secret + order + value)orderNumber adjustment
PartnerizeGET/POST tracking endpointclickrefcampaign id; API key for updatesconversion update API
RakutenGET/XMLranMID/ranSiteIDtokencorrections feed
WebgainsGET track.webgains.com/transactwgcampaignid/clickrefprogram idvia API
Digistore24inbound IPNvendor sidesha_sign (SHA-512 over sorted fields + passphrase)IPN refund/chargeback events
AdcellGET t.adcell.com/t/trackbidpid/eventidstatus update
BelboonGET tracking pixelbbcidtracking keyvia network
TUNEGET aff_saletransaction_idoffer_id/goal_id; optional security tokenadjustment
EverflowGET sdk/conversiontransaction_idnid + optional security_tokenadjustment endpoint
CustomGET/POST templateyour choicenone / basic / bearer / querytemplate

These presets are declarative templates in Track; the wizard shows the rendered URL or body with placeholders before you activate anything, and the parameter names above come from each network's current advertiser documentation, linked in the destination's help text.

Inbound: when the network calls you

Some platforms report the sale to you instead (Digistore24's IPN, or a network's postback to your own endpoint). Track exposes an inbound URL per site and preset. It verifies the request — Digistore24's sha_sign, a shared secret token for generic presets — and turns it into a verified purchase or refund event that flows through the same router. Unverified requests are rejected and counted in the destination's health.

Preventing duplicate commissions

  • One postback per order reference: the ingest stage marks a second purchase with the same order id as a duplicate conversion, and each delivery is keyed on the event id, so a replayed webhook does not fire twice.
  • Networks apply their own duplicate protection on the order reference; a second postback with the same reference is ignored or flagged.
  • Voucher codes belong on the postback (vc, coupon, promo_code depending on network) so the network can apply code-based attribution rules rather than paying two publishers.

Testing

Most networks provide a test mode flag (Awin testmode=1, Impact test accounts, TUNE test offers). In Track's test mode the preset's test parameter is set automatically where one exists; where none exists, the wizard sends to the network and shows the response, and you validate the transaction in the network UI before switching the destination live.

Primary sources

Documentation and standards this article is based on.

  1. Awin — Server to server trackingwiki.awin.com
  2. Impact — Conversions APIintegrations.impact.com

Was this article helpful?

Responsible editor

Track editorial team

Product & engineering

The people building Track: engineers and analysts who work on server-side tracking, consent tooling and connector integrations every day.