The 2026 S2S Tracking Architecture: Signed Postbacks and a Prepaid Ledger

1. Why Conversion Reporting Moves to the Server

A conversion pixel is code that runs in the visitor's browser. Whether it fires, and whether it can be matched back to the original click, depends on browser settings, cookie policies, content blockers and page behavior. Neither the advertiser nor the network controls those conditions.

A server-to-server (S2S) postback is an HTTP request sent by the advertiser's own backend. It does not use the visitor's browser or browser cookies. It identifies the click by the click_id that the network issued when the visitor clicked.

• What the postback does not depend on: the visitor's browser, cookies, local storage or script execution at the moment the conversion is reported.
• What it still depends on: the advertiser's landing page must receive the click_id, and the advertiser's systems must keep it until the conversion is reported. Affnet verifies the signed request; it cannot recover a click_id that the advertiser never stored.

2. Architectural Topology: The S2S Closed Loop

Tracking is split so that the visitor's browser is not part of the conversion report. The loop has five steps:

Advertiser Postback Example (Server-Side, Node.js)

The advertiser's backend signs the exact JSON body with its HMAC secret and sends it in one POST. The secret belongs in server-side configuration and must never be placed in browser code. The example uses a placeholder variable, not a real secret.

import { createHmac, randomUUID } from "node:crypto";

// The HMAC secret is issued to the advertiser by the network.
// Keep it in server-side configuration. Never ship it to a browser.
const secret = process.env.POSTBACK_SECRET;
if (!secret) throw new Error("POSTBACK_SECRET is not configured");

// clickId is the click_id your landing page received and your system stored.
const body = JSON.stringify({
  click_id: clickId,
  nonce: randomUUID(),
  ts: Math.floor(Date.now() / 1000),
  event: "qualified_lead", // "approved_sale" for a CPA offer
});

const signature = createHmac("sha256", secret).update(body, "utf8").digest("hex");

const response = await fetch("https://affnet.net/api/postback/v2", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Postback-Signature": signature,
  },
  body, // send exactly the string that was signed
});

• The signature is the lowercase hex HMAC-SHA256 of the raw request body, sent in the X-Postback-Signature header.
• The body carries click_id, nonce, ts and event. The final events are qualified_lead for CPL and approved_sale for CPA.
• ts is Unix seconds and must be within 300 seconds of server time. A nonce that was already used with a different body is rejected, which is the replay protection.
• The first decision recorded for a click is permanent. A later request for the same click returns that earlier decision and is not evaluated again.

3. Prepaid Ledger Mechanics: Final Conversions Are Not Advertiser-Cancellable

Affnet uses a prepaid model. Advertisers fund their balance in USD and allocate funds to offers. When a final conversion is recorded at /api/postback/v2, one database transaction performs these steps together:

If the allocated balance cannot cover a payable event, consumption is rejected as capacity_exhausted and no funds move. The advertiser can retry after the balance is topped up.

Once a final conversion is recorded, the advertiser cannot change it through the postback protocol. An exceptional correction is an administrator-only, audited operation that adds a compensating entry. It does not rewrite or delete the original record.