{"id":1731,"date":"2026-07-12T17:00:00","date_gmt":"2026-07-12T22:00:00","guid":{"rendered":"https:\/\/tolinku.com\/blog\/?p=1731"},"modified":"2026-03-07T03:50:05","modified_gmt":"2026-03-07T08:50:05","slug":"postback-urls-attribution","status":"publish","type":"post","link":"https:\/\/tolinku.com\/blog\/postback-urls-attribution\/","title":{"rendered":"Postback URLs for Mobile Attribution: How They Work"},"content":{"rendered":"\n

A postback URL is a server-to-server callback that fires when a conversion event occurs. When a user installs your app, your attribution system sends an HTTP request to the ad network's postback URL with the install details: campaign ID, device identifier, timestamp, and any custom data. The ad network uses this data to optimize its campaigns and report conversions.<\/p>\n\n\n\n

This guide covers how postback URLs work in mobile attribution. For the install attribution flow, see install attribution flow: from ad click to first open<\/a>. For webhook integrations, see webhooks and integrations for deep linking<\/a>.<\/p>\n\n\n\n

How Postback URLs Work<\/h2>\n\n\n\n

The Flow<\/h3>\n\n\n\n
1. User clicks ad on Ad Network A\n2. Ad Network A records click with click_id=ABC123\n3. User installs and opens app\n4. Attribution provider determines Ad Network A drove the install\n5. Attribution provider sends HTTP GET\/POST to Ad Network A's postback URL:\n   https:\/\/postback.adnetwork-a.com\/install?click_id=ABC123&app_id=com.yourapp&event=install\n6. Ad Network A records the conversion and optimizes future ad delivery\n<\/code><\/pre>\n\n\n\n
Postback URL Structure<\/h3>\n\n\n\n
A typical postback URL uses macro placeholders that the attribution provider replaces with actual values:<\/p>\n\n\n\n
https:\/\/postback.adnetwork.com\/conversion?\n  click_id={click_id}&\n  app_id={app_id}&\n  event_name={event_name}&\n  event_time={event_time}&\n  device_id={device_id}&\n  revenue={revenue}&\n  currency={currency}\n<\/code><\/pre>\n\n\n\n
The macros (values in curly braces) are replaced at send time:<\/p>\n\n\n\n
https:\/\/postback.adnetwork.com\/conversion?\n  click_id=ABC123&\n  app_id=com.yourapp&\n  event_name=install&\n  event_time=1720780200&\n  device_id=hashed_gaid&\n  revenue=0&\n  currency=USD\n<\/code><\/pre>\n\n\n\n
Common Postback Macros<\/h2>\n\n\n\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Macro<\/th>\nDescription<\/th>\nExample<\/th>\n<\/tr>\n<\/thead>\n
{click_id}<\/code><\/td>\nAd network's click identifier<\/td>\nABC123<\/code><\/td>\n<\/tr>\n
{app_id}<\/code><\/td>\nApp bundle ID \/ package name<\/td>\ncom.yourapp<\/code><\/td>\n<\/tr>\n
{event_name}<\/code><\/td>\nConversion event name<\/td>\ninstall<\/code>, purchase<\/code>, signup<\/code><\/td>\n<\/tr>\n
{event_time}<\/code><\/td>\nEvent timestamp (Unix)<\/td>\n1720780200<\/code><\/td>\n<\/tr>\n
{device_id}<\/code><\/td>\nDevice advertising ID (hashed)<\/td>\nsha256_of_gaid<\/code><\/td>\n<\/tr>\n
{idfa}<\/code><\/td>\niOS Identifier for Advertisers<\/td>\nA1B2C3D4-...<\/code><\/td>\n<\/tr>\n
{gaid}<\/code><\/td>\nGoogle Advertising ID<\/td>\na1b2c3d4-...<\/code><\/td>\n<\/tr>\n
{revenue}<\/code><\/td>\nRevenue amount<\/td>\n9.99<\/code><\/td>\n<\/tr>\n
{currency}<\/code><\/td>\nRevenue currency<\/td>\nUSD<\/code><\/td>\n<\/tr>\n
{campaign_id}<\/code><\/td>\nCampaign identifier<\/td>\nCAMP-789<\/code><\/td>\n<\/tr>\n
{ad_group_id}<\/code><\/td>\nAd group identifier<\/td>\nAG-456<\/code><\/td>\n<\/tr>\n
{creative_id}<\/code><\/td>\nCreative identifier<\/td>\nCR-123<\/code><\/td>\n<\/tr>\n
{country}<\/code><\/td>\nInstall country (ISO 3166)<\/td>\nUS<\/code><\/td>\n<\/tr>\n
{os_version}<\/code><\/td>\nDevice OS version<\/td>\n17.5<\/code><\/td>\n<\/tr>\n
{ip}<\/code><\/td>\nUser's IP address<\/td>\n203.0.113.42<\/code><\/td>\n<\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n
Types of Postbacks<\/h2>\n\n\n\n
Install Postback<\/h3>\n\n\n\n
Fires when the app is installed and opened for the first time:<\/p>\n\n\n\n
https:\/\/postback.adnetwork.com\/install?\n  click_id={click_id}&\n  event=install&\n  event_time={event_time}&\n  device_id={device_id}\n<\/code><\/pre>\n\n\n\n
In-App Event Postback<\/h3>\n\n\n\n
Fires when the user completes a specific in-app event (purchase, registration, level completion):<\/p>\n\n\n\n
https:\/\/postback.adnetwork.com\/event?\n  click_id={click_id}&\n  event={event_name}&\n  event_time={event_time}&\n  revenue={revenue}&\n  currency={currency}\n<\/code><\/pre>\n\n\n\n
Revenue Postback<\/h3>\n\n\n\n
A specialized in-app event postback that includes revenue data for ROAS (Return on Ad Spend) optimization:<\/p>\n\n\n\n
https:\/\/postback.adnetwork.com\/revenue?\n  click_id={click_id}&\n  event=purchase&\n  revenue=49.99&\n  currency=USD&\n  product_id=premium_annual\n<\/code><\/pre>\n\n\n\n
Rejection Postback<\/h3>\n\n\n\n
Fires when an install claim is rejected (fraud, duplicate, wrong attribution):<\/p>\n\n\n\n
https:\/\/postback.adnetwork.com\/reject?\n  click_id={click_id}&\n  rejection_reason=fraud_detected&\n  event_time={event_time}\n<\/code><\/pre>\n\n\n\n
Configuring Postback URLs<\/h2>\n\n\n\n
Setting Up a Postback<\/h3>\n\n\n\n
Each ad network provides its own postback URL template. You configure this in your attribution provider's dashboard:<\/p>\n\n\n\n
{\n  "network": "Ad Network A",\n  "postback_url": "https:\/\/postback.adnetwork-a.com\/conversion?click_id={click_id}&event={event_name}&revenue={revenue}",\n  "events": ["install", "purchase", "registration"],\n  "send_for": "attributed_only",\n  "method": "GET"\n}\n<\/code><\/pre>\n\n\n\n
Event Mapping<\/h3>\n\n\n\n
Map your in-app events to the ad network's expected event names:<\/p>\n\n\n\n
\n\n\n\n\n\n\n\n
Your Event<\/th>\nAd Network Event<\/th>\nPostback<\/th>\n<\/tr>\n<\/thead>\n
first_open<\/code><\/td>\ninstall<\/code><\/td>\nInstall postback<\/td>\n<\/tr>\n
registration_complete<\/code><\/td>\nregistration<\/code><\/td>\nEvent postback<\/td>\n<\/tr>\n
first_purchase<\/code><\/td>\npurchase<\/code><\/td>\nRevenue postback<\/td>\n<\/tr>\n
subscription_start<\/code><\/td>\nsubscribe<\/code><\/td>\nRevenue postback<\/td>\n<\/tr>\n
tutorial_complete<\/code><\/td>\ntutorial<\/code><\/td>\nEvent postback<\/td>\n<\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n
Building Your Own Postback System<\/h2>\n\n\n\n
If you are building attribution in-house, here is how to implement postback sending:<\/p>\n\n\n\n
interface PostbackConfig {\n  networkId: string;\n  urlTemplate: string;\n  events: string[];\n  method: 'GET' | 'POST';\n  retryPolicy: { maxRetries: number; backoffMs: number };\n}\n\nasync function sendPostback(\n  config: PostbackConfig,\n  eventData: Record<string, string>\n): Promise<void> {\n  \/\/ Replace macros in URL template\n  let url = config.urlTemplate;\n  for (const [key, value] of Object.entries(eventData)) {\n    url = url.replace(`{${key}}`, encodeURIComponent(value));\n  }\n\n  \/\/ Remove any unreplaced macros\n  url = url.replace(\/\\{[^}]+\\}\/g, '');\n\n  for (let attempt = 0; attempt <= config.retryPolicy.maxRetries; attempt++) {\n    try {\n      const response = await fetch(url, { method: config.method });\n\n      if (response.ok) {\n        console.log(`Postback sent to ${config.networkId}: ${response.status}`);\n        return;\n      }\n\n      if (response.status >= 500) {\n        \/\/ Server error, retry\n        await sleep(config.retryPolicy.backoffMs * Math.pow(2, attempt));\n        continue;\n      }\n\n      \/\/ Client error (4xx), don't retry\n      console.error(`Postback failed for ${config.networkId}: ${response.status}`);\n      return;\n    } catch (error) {\n      if (attempt < config.retryPolicy.maxRetries) {\n        await sleep(config.retryPolicy.backoffMs * Math.pow(2, attempt));\n      }\n    }\n  }\n\n  console.error(`Postback to ${config.networkId} failed after ${config.retryPolicy.maxRetries} retries`);\n}\n<\/code><\/pre>\n\n\n\n
Postback Validation<\/h2>\n\n\n\n
Verifying Incoming Postbacks<\/h3>\n\n\n\n
If you receive postbacks (e.g., from ad networks reporting click data), validate them:<\/p>\n\n\n\n
function validatePostback(request: Request, networkSecret: string): boolean {\n  \/\/ Check signature\n  const signature = request.headers.get('X-Signature');\n  const body = request.body;\n  const expectedSignature = hmacSHA256(body, networkSecret);\n\n  if (signature !== expectedSignature) {\n    return false;\n  }\n\n  \/\/ Check timestamp freshness (prevent replay attacks)\n  const timestamp = parseInt(request.url.searchParams.get('event_time') || '0');\n  const now = Math.floor(Date.now() \/ 1000);\n\n  if (Math.abs(now - timestamp) > 3600) {\n    return false; \/\/ More than 1 hour old\n  }\n\n  return true;\n}\n<\/code><\/pre>\n\n\n\n
Common Postback Failures<\/h3>\n\n\n\n
\n\n\n\n\n\n\n\n
Issue<\/th>\nCause<\/th>\nFix<\/th>\n<\/tr>\n<\/thead>\n
404 response<\/td>\nWrong postback URL<\/td>\nVerify URL with ad network<\/td>\n<\/tr>\n
Missing click_id<\/td>\nMacro not replaced<\/td>\nCheck macro syntax matches provider's format<\/td>\n<\/tr>\n
Duplicate postbacks<\/td>\nRetry logic without dedup<\/td>\nAdd idempotency keys<\/td>\n<\/tr>\n
Delayed postbacks<\/td>\nQueue backlog<\/td>\nMonitor queue depth, scale workers<\/td>\n<\/tr>\n
Empty revenue<\/td>\nRevenue macro not mapped<\/td>\nMap revenue events correctly<\/td>\n<\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n
Privacy and Postbacks<\/h2>\n\n\n\n
ATT and IDFA<\/h3>\n\n\n\n
On iOS, if the user has not consented to tracking via ATT<\/a>, the IDFA is unavailable. Postbacks must use alternative identifiers:<\/p>\n\n\n\n