{"id":1755,"date":"2026-07-15T13:00:00","date_gmt":"2026-07-15T18:00:00","guid":{"rendered":"https:\/\/tolinku.com\/blog\/?p=1755"},"modified":"2026-03-07T03:50:07","modified_gmt":"2026-03-07T08:50:07","slug":"server-to-server-attribution","status":"publish","type":"post","link":"https:\/\/tolinku.com\/blog\/server-to-server-attribution\/","title":{"rendered":"Server-to-Server Attribution: Architecture Guide"},"content":{"rendered":"\n

Server-to-server (S2S) attribution moves attribution logic from the client (app SDK) to the server. Instead of the attribution SDK on the device making decisions, your server receives events from the app, queries ad networks' APIs, performs the attribution match, and sends postbacks. This approach gives you more control, better privacy, and independence from third-party SDKs.<\/p>\n\n\n\n

This guide covers S2S attribution architecture. For server-side deferred matching, see server-side deferred matching: architecture guide<\/a>. For postback URLs, see postback URLs for mobile attribution<\/a>.<\/p>\n\n\n\n

Why Server-to-Server<\/h2>\n\n\n\n

Benefits<\/h3>\n\n\n\n
\n\n\n\n\n\n\n\n
Benefit<\/th>\nExplanation<\/th>\n<\/tr>\n<\/thead>\n
Privacy control<\/td>\nUser data stays on your server. No third-party SDK phoning home.<\/td>\n<\/tr>\n
SDK independence<\/td>\nNo attribution SDK in your app. Reduces app size, avoids SDK conflicts.<\/td>\n<\/tr>\n
Data ownership<\/td>\nYou own the raw attribution data, not a third-party provider.<\/td>\n<\/tr>\n
Flexibility<\/td>\nCustom attribution logic, custom windows, custom fraud rules.<\/td>\n<\/tr>\n
Security<\/td>\nServer-to-server communication uses API keys, not client-side tokens.<\/td>\n<\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n

Trade-Offs<\/h3>\n\n\n\n
\n\n\n\n\n\n\n
Trade-Off<\/th>\nExplanation<\/th>\n<\/tr>\n<\/thead>\n
Engineering cost<\/td>\nYou build and maintain the attribution system.<\/td>\n<\/tr>\n
SAN integration<\/td>\nSelf-attributing networks (Meta, Google) have complex S2S APIs.<\/td>\n<\/tr>\n
Maintenance<\/td>\nSDK updates for platform changes (ATT, Privacy Sandbox) are your responsibility.<\/td>\n<\/tr>\n
No managed dashboard<\/td>\nYou build your own reporting (or use a BI tool).<\/td>\n<\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n

Architecture<\/h2>\n\n\n\n
\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510     \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510     \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502  Mobile App \u2502\u2500\u2500\u2500\u2500\u2192\u2502  Your Server \u2502\u2500\u2500\u2500\u2500\u2192\u2502  Ad Networks  \u2502\n\u2502  (minimal)  \u2502     \u2502  (attribution\u2502     \u2502  (postbacks)  \u2502\n\u2502             \u2502     \u2502   logic)     \u2502     \u2502              \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                           \u2502\n                           \u2193\n                    \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                    \u2502  Click Store \u2502\n                    \u2502  (Redis\/DB)  \u2502\n                    \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\n\n\n\n
Components<\/h3>\n\n\n\n
    \n
  1. Mobile app.<\/strong> Sends minimal events to your server: first open, registration, purchase, etc. No attribution SDK needed.<\/p>\n\n\n\n
    Click tracking endpoint.<\/strong> Receives clicks from ad campaigns. Records click data (device ID, campaign, timestamp) in the click store.<\/p>\n\n\n\n
    Attribution engine.<\/strong> When a first-open event arrives, queries the click store for matching clicks and runs the attribution logic.<\/p>\n\n\n\n
    Postback sender.<\/strong> Sends attribution results to ad networks via their postback URLs.<\/p>\n\n\n\n
    Click store.<\/strong> Fast key-value store (Redis) for click lookup. Indexed by device ID.<\/p>\n\n\n\n
    Implementation<\/h2>\n\n\n\n
    Click Tracking<\/h3>\n\n\n\n
    When a user clicks an ad, the ad network redirects through your click tracking endpoint:<\/p>\n\n\n\n
    \/\/ GET \/track\/click?network=facebook&campaign=CAMP-123&device_id=...&click_id=...\napp.get('\/track\/click', async (req, res) => {\n  const click: Click = {\n    id: generateId(),\n    networkId: req.query.network as string,\n    campaignId: req.query.campaign as string,\n    adGroupId: req.query.ad_group as string,\n    creativeId: req.query.creative as string,\n    deviceId: req.query.device_id as string,\n    clickId: req.query.click_id as string,\n    ip: req.ip,\n    userAgent: req.headers['user-agent'] || '',\n    timestamp: Date.now(),\n    referrer: req.query.referrer as string\n  };\n\n  \/\/ Store click\n  await clickStore.record(click);\n\n  \/\/ Redirect to app store or Universal Link\n  const redirectUrl = req.query.redirect_url as string;\n  res.redirect(302, redirectUrl);\n});\n<\/code><\/pre>\n\n\n\n
    First Open Event<\/h3>\n\n\n\n
    When the app opens for the first time, it sends a lightweight event to your server:<\/p>\n\n\n\n
    \/\/ iOS: Send first open event\nfunc sendFirstOpenEvent() {\n    let event: [String: Any] = [\n        "event": "first_open",\n        "device_id": getDeviceId(),\n        "idfa": getIDFA(), \/\/ nil if ATT not consented\n        "idfv": UIDevice.current.identifierForVendor?.uuidString ?? "",\n        "os": "ios",\n        "os_version": UIDevice.current.systemVersion,\n        "app_version": Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "",\n        "timestamp": Date().timeIntervalSince1970,\n        "locale": Locale.current.identifier,\n        "timezone": TimeZone.current.identifier\n    ]\n\n    URLSession.shared.dataTask(with: buildRequest("\/v1\/events", body: event)).resume()\n}\n<\/code><\/pre>\n\n\n\n
    Attribution Engine<\/h3>\n\n\n\n
    interface AttributionResult {\n  attributed: boolean;\n  source: 'paid' | 'organic';\n  networkId?: string;\n  campaignId?: string;\n  clickId?: string;\n  matchType: 'deterministic' | 'probabilistic' | 'organic';\n}\n\nasync function attributeInstall(event: InstallEvent): Promise<AttributionResult> {\n  \/\/ Step 1: Deterministic match (device ID)\n  if (event.deviceId) {\n    const clicks = await clickStore.getByDeviceId(event.deviceId, { within: '7d' });\n\n    if (clicks.length > 0) {\n      const bestClick = selectBestClick(clicks); \/\/ Last-click model\n      const fraudCheck = await checkFraud(event, bestClick);\n\n      if (!fraudCheck.isFraud) {\n        return {\n          attributed: true,\n          source: 'paid',\n          networkId: bestClick.networkId,\n          campaignId: bestClick.campaignId,\n          clickId: bestClick.clickId,\n          matchType: 'deterministic'\n        };\n      }\n    }\n  }\n\n  \/\/ Step 2: Probabilistic match (IP + User Agent)\n  const probClicks = await clickStore.getByIPAndUA(\n    event.ip,\n    event.userAgent,\n    { within: '24h' }\n  );\n\n  if (probClicks.length > 0) {\n    const bestClick = selectBestClick(probClicks);\n    return {\n      attributed: true,\n      source: 'paid',\n      networkId: bestClick.networkId,\n      campaignId: bestClick.campaignId,\n      clickId: bestClick.clickId,\n      matchType: 'probabilistic'\n    };\n  }\n\n  \/\/ Step 3: Organic\n  return {\n    attributed: false,\n    source: 'organic',\n    matchType: 'organic'\n  };\n}\n<\/code><\/pre>\n\n\n\n
    Postback Sending<\/h3>\n\n\n\n
    After attribution, send results to the ad network:<\/p>\n\n\n\n
    async function sendPostback(result: AttributionResult, event: InstallEvent): Promise<void> {\n  if (!result.attributed || !result.networkId) return;\n\n  const network = await getNetworkConfig(result.networkId);\n  if (!network.postbackUrl) return;\n\n  const url = network.postbackUrl\n    .replace('{click_id}', result.clickId || '')\n    .replace('{event}', 'install')\n    .replace('{timestamp}', String(event.timestamp))\n    .replace('{device_id}', event.deviceId || '');\n\n  try {\n    const response = await fetch(url, { method: 'GET' });\n    await logPostback(result, response.status);\n  } catch (error) {\n    await logPostbackError(result, error);\n    \/\/ Queue for retry\n    await retryQueue.add({ url, result, attempt: 1 });\n  }\n}\n<\/code><\/pre>\n\n\n\n
    Self-Attributing Network Integration<\/h2>\n\n\n\n
    SANs (Meta, Google, TikTok) require special S2S integration because they do not use standard click tracking:<\/p>\n\n\n\n
    Meta Conversions API<\/h3>\n\n\n\n
    async function sendMetaConversion(event: InstallEvent): Promise<void> {\n  const payload = {\n    data: [{\n      event_name: 'app_install',\n      event_time: Math.floor(event.timestamp \/ 1000),\n      user_data: {\n        client_ip_address: event.ip,\n        client_user_agent: event.userAgent,\n        madid: event.deviceId \/\/ Mobile Advertiser ID\n      },\n      app_data: {\n        application_tracking_enabled: event.attConsented ? 1 : 0,\n        advertiser_tracking_enabled: event.attConsented ? 1 : 0\n      }\n    }]\n  };\n\n  await fetch(\n    `https:\/\/graph.facebook.com\/v18.0\/${PIXEL_ID}\/events?access_token=${ACCESS_TOKEN}`,\n    {\n      method: 'POST',\n      headers: { 'Content-Type': 'application\/json' },\n      body: JSON.stringify(payload)\n    }\n  );\n}\n<\/code><\/pre>\n\n\n\n
    Google Measurement Protocol<\/h3>\n\n\n\n
    async function sendGoogleConversion(event: InstallEvent): Promise<void> {\n  const payload = {\n    client_id: event.deviceId,\n    events: [{\n      name: 'first_open',\n      params: {\n        campaign: event.attributedCampaign,\n        source: 'google',\n        medium: 'cpc'\n      }\n    }]\n  };\n\n  await fetch(\n    `https:\/\/www.google-analytics.com\/mp\/collect?measurement_id=${GA_ID}&api_secret=${API_SECRET}`,\n    {\n      method: 'POST',\n      body: JSON.stringify(payload)\n    }\n  );\n}\n<\/code><\/pre>\n\n\n\n
    Data Storage<\/h2>\n\n\n\n
    Click Store Schema<\/h3>\n\n\n\n
    CREATE TABLE clicks (\n  id TEXT PRIMARY KEY,\n  network_id TEXT NOT NULL,\n  campaign_id TEXT,\n  ad_group_id TEXT,\n  creative_id TEXT,\n  device_id TEXT,\n  click_id TEXT,\n  ip_address TEXT,\n  user_agent TEXT,\n  timestamp BIGINT NOT NULL,\n  INDEX idx_device_id (device_id),\n  INDEX idx_ip_ua (ip_address, user_agent),\n  INDEX idx_timestamp (timestamp)\n);\n\n-- TTL: Delete clicks older than 30 days\n<\/code><\/pre>\n\n\n\n
    Attribution Log Schema<\/h3>\n\n\n\n
    CREATE TABLE attributions (\n  id TEXT PRIMARY KEY,\n  device_id TEXT,\n  event_type TEXT NOT NULL,\n  attributed BOOLEAN NOT NULL,\n  source TEXT NOT NULL, -- 'paid' or 'organic'\n  network_id TEXT,\n  campaign_id TEXT,\n  click_id TEXT,\n  match_type TEXT, -- 'deterministic', 'probabilistic', 'organic'\n  event_timestamp BIGINT NOT NULL,\n  attribution_timestamp BIGINT NOT NULL,\n  postback_sent BOOLEAN DEFAULT FALSE,\n  INDEX idx_device (device_id),\n  INDEX idx_campaign (campaign_id)\n);\n<\/code><\/pre>\n\n\n\n
    Tolinku for S2S Attribution<\/h2>\n\n\n\n
    Tolinku<\/a> provides server-side click tracking and attribution via its API<\/a>. Deep link clicks are tracked server-side, and attribution data is available through the dashboard and API. This gives you S2S attribution for deep link campaigns without building the full infrastructure.<\/p>\n\n\n\n
    For mobile attribution, see mobile attribution: a developer's guide<\/a>. For server-side deferred matching, see server-side deferred matching: architecture guide<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
    Implement server-to-server attribution for mobile apps. Build secure, privacy-compliant attribution without client-side SDK dependencies.<\/p>\n","protected":false},"author":2,"featured_media":1754,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"rank_math_title":"Server-to-Server Attribution: Architecture Guide","rank_math_description":"Implement server-to-server attribution for mobile apps. Build secure, privacy-compliant attribution without client-side SDK dependencies.","rank_math_focus_keyword":"server-to-server attribution","rank_math_canonical_url":"","rank_math_facebook_title":"","rank_math_facebook_description":"","rank_math_facebook_image":"https:\/\/tolinku.com\/blog\/wp-content\/uploads\/2026\/03\/og-server-to-server-attribution.png","rank_math_facebook_image_id":"","rank_math_twitter_title":"","rank_math_twitter_description":"","rank_math_twitter_image":"https:\/\/tolinku.com\/blog\/wp-content\/uploads\/2026\/03\/og-server-to-server-attribution.png","footnotes":""},"categories":[14],"tags":[37,62,305,28,20,69,36,333],"class_list":["post-1755","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analytics","tag-analytics","tag-api","tag-architecture","tag-attribution","tag-deep-linking","tag-mobile-development","tag-privacy","tag-server-side"],"_links":{"self":[{"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/posts\/1755","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/comments?post=1755"}],"version-history":[{"count":3,"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/posts\/1755\/revisions"}],"predecessor-version":[{"id":2699,"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/posts\/1755\/revisions\/2699"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/media\/1754"}],"wp:attachment":[{"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/media?parent=1755"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/categories?post=1755"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tolinku.com\/blog\/wp-json\/wp\/v2\/tags?post=1755"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}