Postback vs Callback Tracking: What iGaming Affiliate Managers Need to Know

If your affiliate program is misfiring conversions, you are either overpaying affiliates or underpaying them. Both are bad — overpaying burns margin, underpaying kills affiliate relationships.

The tracking method you choose determines how accurately your system knows when a player registers, deposits, or qualifies. Get it wrong and you are running an affiliate program on guesswork.

The two main methods you will encounter when setting up or auditing an iGaming affiliate program are postback URL tracking (also called server-to-server or S2S tracking) and callback tracking (also called pixel tracking or client-side tracking). They look similar on the surface. They work very differently underneath.

Here is what each one actually does, where each one breaks, and which you should be using.

What Is Postback Tracking?

Postback tracking is a server-to-server method. When a conversion event fires — a player registers, makes a first deposit, hits a qualifying wagering threshold — your platform sends an HTTP request directly from your server to the affiliate network or tracking platform’s server.

No browser involved. No cookies. No JavaScript.

Here is the flow:

A player clicks an affiliate link. The link appends a unique click ID (also called a token or sub-ID) to the URL — something like ?clickid=abc123.
That click ID gets stored by the tracking platform and passed through to your landing page.
When the player converts, your backend fires an HTTP GET or POST request to the affiliate’s postback URL, with the original click ID passed back in the request.
The affiliate platform matches the click ID to the original click record and logs the conversion.

The whole process happens server-side. The player’s browser does nothing after the initial click.

This is why postback tracking is sometimes called S2S (server-to-server) tracking — there are exactly two servers talking to each other, with no client in the middle.

What Is Callback Tracking?

Callback tracking (or pixel tracking) works in the player’s browser. When a conversion event happens, a piece of JavaScript or a tiny image pixel fires from the player’s browser and sends conversion data back to the tracking platform.

The flow looks like this:

A player clicks an affiliate link. A cookie is dropped in their browser recording the click source.
When the player converts, the conversion page loads a JavaScript event or a 1×1 pixel image that fires the conversion signal.
The tracking platform reads the cookie from step one, matches it to the click, and records the conversion.

This method depends on three things lining up: the cookie must still be present, the browser must run the JavaScript, and the network must load the pixel. If any one of those conditions fails, the conversion is lost.

Postback vs Callback: Side-by-Side Comparison

Factor	Postback (S2S)	Callback (Pixel)
How it fires	Server HTTP request	Browser JavaScript or image pixel
Cookie dependency	None	Required
Ad blocker resistance	High — not client-side	Low — frequently blocked
Works in incognito mode	Yes	Often no
iOS / Safari ITP affected	No	Yes — 7-day cookie limit
GDPR / consent requirement	Typically no consent needed	Requires cookie consent
Long conversion window support	Yes	Limited by cookie lifetime
Implementation complexity	Higher — requires backend dev	Lower — paste a pixel
Accuracy	High	Moderate to low
Best for	iGaming operators, performance affiliates	Informational / content sites

Why iGaming Affiliate Programs Default to Postback

The iGaming player journey breaks callback tracking in multiple ways. Here is what you are actually dealing with:

Players use incognito mode. A significant share of gambling-adjacent traffic comes through private browsing. No persistent cookies get written. Callback tracking has nothing to match against.

VPN usage is high. Players switching IPs mid-session can cause cookie mismatches that break callback attribution.

Conversion windows are long. A player might click an affiliate link today and not make a first deposit for four days. Browsers like Safari (via Intelligent Tracking Prevention) expire affiliate cookies within 24 hours to 7 days. Postback tracking has no expiry — the click ID lives on your server until it is matched.

GDPR consent creates data gaps. If a player dismisses the cookie consent banner, callback tracking collects nothing. Postback tracking does not write cookies to the browser, so it operates outside consent requirements in most interpretations (though always verify with your legal counsel for your specific jurisdiction).

The stakes per conversion are high. In iGaming, a single qualified depositing player is worth a meaningful commission — in CPA terms, that can range from €50 to several hundred euros depending on the market and product. A tracking miss is not a rounding error. It is a dispute.

Postback tracking avoids all of these problems because the conversion signal never passes through the browser. It goes directly from your platform to the affiliate network’s server. The player’s device, browser settings, cookie state, or IP situation are irrelevant.

When Callback Tracking Is Still Used

Callback / pixel tracking has not disappeared entirely, even in iGaming. You will still see it used in a few specific situations.

Supplementary attribution for brand campaigns. Some operators run display or social campaigns where pixel tracking through platforms like Meta or Google is unavoidable for audience optimization. In these cases, the pixel tracks ad platform performance, not affiliate commissions — a different use case entirely.

Affiliate programs that have not yet migrated. Older iGaming affiliate programs that were built before S2S tracking became the norm sometimes still use hybrid setups. If you are inheriting an older program, this is worth auditing.

Information and content sites. Not every site that refers players runs performance affiliate links. Content publishers sometimes fire a pixel for analytics or retargeting purposes — not for commission attribution.

For commission attribution — the actual tracking of whether an affiliate earned their payment — postback is the standard in iGaming. The main platforms in the space (Scaleo, NetRefer, Income Access, SoftSwiss Affilka, MyAffiliates) all support postback as the primary tracking method for this reason.

How Postback Tracking Works in Practice

Setting up postback tracking requires coordination between your affiliate platform and your backend. Here is the practical flow.

Step 1: Get your postback URL from the affiliate platform.

Your affiliate management platform generates a postback URL. It looks something like this:

https://track.yourplatform.com/postback?clickid={CLICKID}&event=deposit&amount={AMOUNT}

The {CLICKID} and {AMOUNT} are placeholder tokens that your backend replaces with real values when firing the request.

Step 2: Pass the click ID through to your site.

When an affiliate sends traffic via their link, the click ID gets appended as a URL parameter. Your site needs to capture this parameter and store it — typically in a server-side session or database record tied to that visitor.

https://yourcasino.com/landing?clickid=abc123&utm_source=affiliate_name

Step 3: Pass the click ID into your player registration.

When the player registers, the stored click ID needs to be attached to their player account in your CRM or platform. This is the critical step. If you lose the click ID here, the chain breaks.

Step 4: Fire the postback on conversion.

When the qualifying event fires (registration, first deposit, FTD, NGR threshold — whatever your CPA terms specify), your backend sends the HTTP request:

https://track.yourplatform.com/postback?clickid=abc123&event=ftd&amount=100

Your platform receives the request, matches clickid=abc123 to the original click record, and credits the conversion to the affiliate.

Step 5: Verify in your platform’s reporting.

Every postback request should generate a log entry. Check that fired postbacks match your internal conversion counts. Discrepancies of more than 1-2% are worth investigating.

Common Postback Setup Mistakes to Avoid

These are the errors that cause disputes and missed commissions in iGaming affiliate programs.

Click ID not persisted across the player journey. The click ID is captured on the landing page but not stored when the player navigates to the registration page. Use a server-side session or database — do not rely on URL parameter passing across multiple page loads.

Postback fires on the wrong event. A CPA program pays on first deposit, but the postback fires on registration. You end up crediting affiliates for players who never funded. Always tie the postback trigger to the qualifying conversion event in your terms.

Token not populated in the postback URL. The request fires but the click ID placeholder is empty: ?clickid=&event=ftd. The platform cannot match an empty string. Check your postback logs for blank token values — this is common when player records get created without a click ID in the source field.

No deduplication logic. A player deposits twice on the same day. Two postbacks fire for the same click ID. Depending on your platform configuration, this might credit the affiliate twice for one customer. Set deduplication rules at the platform level.

Postback URL encoded incorrectly. Special characters in the amount or other parameters can corrupt the URL if not encoded properly. Always URL-encode dynamic values before appending them to postback requests.

Testing in production. Always use a test environment with dedicated test accounts and verify the full postback chain before pushing to live affiliate traffic.

FAQ

What is the difference between a postback URL and a callback URL?

In most affiliate tracking contexts, postback URL and callback URL refer to the same mechanism — a server-side URL that gets called when a conversion fires. Some platforms use the terms interchangeably. Where a distinction exists, “postback” typically refers specifically to the S2S tracking model, while “callback” can refer more broadly to any notification mechanism including client-side events.

Does postback tracking require cookie consent under GDPR?

Postback tracking does not write cookies to the player’s browser. In most interpretations, this means it does not require cookie consent in the same way that pixel tracking does. That said, you are still processing click IDs that can be linked to player accounts, which means your data processing policies and DPA agreements with affiliate platforms still apply. Get confirmation from your legal team for your specific setup.

What click ID parameter should I use?

This depends on your affiliate platform. Common parameter names include clickid, subid, aff_sub, click_id, and s1. Your platform documentation will specify the correct parameter. Make sure the same parameter name is used consistently across your affiliate links and your postback URL.

How do I test my postback setup?

Most affiliate platforms provide a postback testing tool or a test endpoint. Run a test click with a known click ID, complete the conversion flow with a test account, and verify the postback appears in your platform’s conversion log. Check both that the request fired and that the click ID matched correctly.

Can I use both postback and pixel tracking?

Yes, and some programs do. Postback handles commission attribution; pixels handle ad platform optimization signals. They serve different purposes and can run in parallel. Just make sure you are not counting the same conversion twice across both systems.

What is the standard postback setup for major iGaming affiliate platforms?

Most major iGaming affiliate platforms (Scaleo, NetRefer, SoftSwiss Affilka, Income Access) provide a postback URL generator inside the affiliate manager interface. You configure the tracking tokens, select which conversion events trigger a postback, and the platform generates the URL. Your backend dev then implements the firing logic on your side. Most platforms also provide API documentation and sandbox testing environments.

The Bottom Line

Postback tracking is the correct choice for iGaming affiliate commission attribution. The player behavior patterns in this industry — incognito browsing, VPN usage, long decision windows, and cookie consent variability — make client-side pixel tracking unreliable enough to cause real commercial disputes.

The implementation requires backend development work, but it is a one-time investment. Once your postback chain is set up and verified, it runs without browser-side dependencies and generates a server log you can audit.

If you are running an affiliate program with pixel-only tracking, the misfires are happening — you may just not know which direction they are falling. Auditing your tracking setup is worth doing before the disputes start.