Also known as:Cookieless Tracking, Postback Tracking, S2S Postback, Server-Side Tracking
What is S2S: Server-to-Server Tracking?
Server-to-Server (S2S) tracking is a conversion-attribution method in which the broker's server sends conversion data directly to the affiliate's tracking server, typically through a postback URL or API call, without relying on the user's browser or cookies. A unique ClickID passed on the outbound click is the key that ties the later deposit back to the original referral.
Standard affiliate tracking stores a cookie in the visitor's browser at click time and reads it back at conversion. That model breaks under Apple's Intelligent Tracking Prevention (ITP), Firefox ETP, ad blockers, private browsing, and cross-device journeys. S2S removes the browser from the equation: instead of a cookie, the affiliate's system generates a ClickID, appends it to the tracking link, the broker stores it against the new account, and fires it back on the qualifying event (registration, first-time deposit, or lot traded).
Key takeaways
S2S passes conversions broker-server to affiliate-server via postback, not via cookies.
A unique ClickID is the shared key that links click to deposit.
Survives ITP, ad blockers, private mode, and cross-device journeys.
Mandatory for paid-traffic optimization and high-volume CPA deals.
Requires a shared secret or IP allowlist to prevent spoofed conversions.
Here is the flow in numbers. An affiliate sends a click to a broker such as Exness or IC Markets with a URL parameter like `?clickid=abc123`. The visitor deposits $500 three days later on a different device. The broker's server calls the affiliate's postback URL, for example `https://track.affnetwork.com/postback?clickid=abc123&payout=400&event=ftd`, and the CPA is credited instantly and accurately even though no cookie survived.
Because the data never touches the client, S2S is both more accurate and more private-compliant than pixel tracking. It is the default integration standard between brokers, affiliate networks (Cellxpert, Income Access, Affise), and paid-traffic sources that need clean conversion signals fed back for optimization.
How it works
At click time the affiliate platform mints a unique ClickID and appends it to the broker's tracking URL as a parameter. The broker captures and stores that ClickID against the prospect's cookie or account record on its own server.
When a tracked event fires (sign-up, first-time deposit, qualified volume), the broker's server sends an HTTP request, the postback, to a URL the affiliate registered in advance, passing back the ClickID plus event type and payout. The affiliate's server matches the ClickID to the original click and records the conversion, then optionally chains a second postback onward to the ad network that supplied the traffic.
Most setups exchange a shared secret or IP allowlist so the postback cannot be spoofed, and dedupe on ClickID so a single deposit is never counted twice.
1
Generate the ClickID
Your tracker (Voluum, RedTrack, Keitaro) creates a unique ClickID for every click and inserts it into the broker link, e.g. ?clickid={cid}.
2
Pass it to the broker
The visitor lands on the broker page carrying the ClickID; the broker stores it against the new lead or account.
3
User converts
The prospect registers and makes a first-time deposit that meets the CPA qualifying threshold.
4
Broker fires the postback
The broker's server calls your postback URL server-to-server, sending clickid, event type, and payout amount.
5
Match and attribute
Your tracker matches the returned ClickID to the original click and books the conversion, no cookie required.
6
Relay to the traffic source
If you buy media, chain the postback onward to Google, Meta, or PropellerAds so their algorithm optimizes toward depositors.
Why it matters for partnership: With browsers killing third-party cookies, S2S is what keeps CPA attribution accurate, so you get paid for every deposit you drive. It is also mandatory for feeding conversions back to ad networks so their algorithms optimize your paid campaigns toward depositors.
Real World Example
An affiliate runs Google Ads to an IC Markets offer through Voluum. A trader clicks on an iPhone with ITP on, then deposits $1,000 two days later on a laptop. Cookie tracking would lose this entirely, but the ClickID stored server-side lets IC Markets fire a postback to Voluum, crediting the $400 CPA and relaying the conversion to Google so the campaign optimizes toward similar depositors.
S2S postback vs. browser (pixel/cookie) tracking
Aspect
S2S postback
Pixel / cookie
Data path
Server to server
Through the browser
Survives ITP / ad blockers
Yes
Often no
Cross-device
Yes
No
Setup difficulty
Higher (URL tokens)
Lower (paste a pixel)
Accuracy for CPA
High
Degrading
Pro Tip
Fire a test conversion end-to-end before scaling spend, confirm the ClickID arrives in your tracker, because a single mismatched token silently transmits zero data.
Common Pitfalls
Mismatching the ClickID parameter name between the outbound link and the postback template, which breaks the match and books every hard-won deposit as unattributed.
FAQ
What is a postback URL?
It is a URL on your tracking server that the broker calls when a conversion happens, passing back the ClickID, event type, and payout so your system can attribute the sale.
Is S2S the same as cookieless tracking?
Effectively yes for affiliates. S2S does not depend on browser cookies, so it is the practical way to keep tracking accurate now that third-party cookies are being blocked.
Do I need coding skills to set up S2S?
Not heavy coding, but you must understand URL parameters and tokens. Most trackers and broker panels provide macro fields; the work is mapping the ClickID correctly on both ends.
Can S2S track first-time deposits and not just sign-ups?
Yes. The broker chooses which events to fire postbacks for, so you can receive separate postbacks for registration, first-time deposit, and qualified volume.
Why do ad networks require S2S?
Platforms like Google and Meta optimize bidding using conversion signals. S2S feeds real depositor events back to them so their algorithm targets users who actually convert, not just clickers.
How is a postback protected from fraud?
Brokers typically use a shared secret token or an IP allowlist so only their server can post conversions, and trackers dedupe on ClickID to avoid double-counting.
A framework for comparing prop firm affiliate programs by commission model, payout terms, and partner reliability, so you can choose a partner that scales with your …
A practical framework for choosing which brokers to onboard onto a multi-broker rebate site, from tracking compatibility to payout reliability and long-term reputation risk.
Sub-ID tracking attaches a custom identifier to every affiliate link so you can see exactly which channel, campaign, or piece of content drove each conversion.
A practical guide to how postback URLs and server-to-server tracking report conversions reliably, the parameters that must match for them to fire, and how to test …
