Server-to-server tracking is the most reliable, fraud-resistant, and privacy-compliant way to track affiliate conversions. Unlike pixel tracking it does not depend on a browser executing JavaScript — which means it works when ad blockers are active, ITP blocks cookies, or users have JavaScript disabled. This guide walks you through a complete implementation.
How S2S Tracking Works
S2S tracking replaces the browser as the intermediary in conversion reporting. Instead of a pixel firing in the user's browser, the advertiser's server sends an HTTP request directly to AffClix's postback endpoint when a conversion occurs. The user's browser is never involved in the attribution signal.
S2S Tracking Flow
User clicks affiliate link → AffClix generates unique click_id
AffClix redirects user to advertiser landing page with click_id in URL
Advertiser stores click_id in first-party cookie (server-side)
User completes purchase — advertiser server fires postback to AffClix
AffClix receives postback, attributes conversion to publisher — done
S2S vs Pixel Tracking
| Factor | Pixel Tracking | S2S Tracking |
|---|---|---|
| Ad blocker resistance | Blocked by ~42% of desktop users | Never affected — server-to-server |
| Safari ITP compatibility | Broken — 1-day cookie cap | Fully compatible |
| JavaScript dependency | Requires JS execution | Zero JS dependency |
| Fraud risk | Bots can trigger pixels | Cannot fake server requests |
| Privacy compliance | Requires cookie consent | No cookie — more privacy-safe |
| Setup complexity | Drop a tag — simple | Requires server integration |
Step 1 — Generate & Store the Click ID
Every affiliate link processed by AffClix generates a unique click_id parameter appended to the redirect URL. This ID must be captured and stored on the advertiser side immediately — the most common S2S failure is losing the click_id between the landing page and the conversion page.
- First-party cookie (recommended) — Set with HttpOnly + Secure flags, 30-day expiry. Survives page reloads, new tabs, and session timeouts.
- URL parameter passthrough — Append to all internal links through the checkout flow. Fragile if any link breaks the chain.
- Session storage only — Not recommended. Lost when user opens a new tab, and expires with the session.
Step 2 — Fire the Postback on Conversion
When a conversion event occurs, your server fires a GET request to your AffClix postback URL. The request must fire server-side — never from browser JavaScript — to bypass ad blockers and avoid bot manipulation.
Postbacks fired via browser JavaScript are blocked by ad blockers (affecting 42% of desktop users). They can also be replayed by bots to generate fake conversions. Always fire from your application server using curl, axios, or similar.
PHP & Node.js Code Examples
// On landing page — store click_id immediately if (isset($_GET['click_id'])) { setcookie('affclix_cid', $_GET['click_id'], time() + 86400 * 30, '/', '', true, true ); } // On order confirmation — fire postback server-side $cid = $_COOKIE['affclix_cid'] ?? null; if ($cid && !Conversion::alreadyFired($order->id)) { $url = 'https://track.affclix.com/pb?' . http_build_query([ 'click_id' => $cid, 'payout' => $order->affiliate_payout, 'currency' => 'USD', 'goal' => 'purchase', 'order_id' => $order->id, ]); $ch = curl_init(); curl_setopt_array($ch, [ CURLOPT_URL => $url, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 5, CURLOPT_SSL_VERIFYPEER => true, ]); curl_exec($ch); curl_close($ch); Conversion::markFired($order->id); }
const axios = require('axios'); async function firePostback(req, order) { const clickId = req.cookies.affclix_cid; if (!clickId) return; try { await axios.get('https://track.affclix.com/pb', { params: { click_id: clickId, payout: order.affiliatePayout, currency: 'USD', goal: 'purchase', order_id: order.id, }, timeout: 5000, }); } catch (err) { logger.warn('Postback failed', { clickId, err: err.message }); } }
Common Failures & Fixes
click_id lost between pages
Store in an HttpOnly first-party cookie (30-day expiry) on the landing page immediately when the click_id is present in the URL.
Postback firing in browser JS
Move the curl/axios call to your application server. Browser JS is blocked by ad blockers on 42% of desktop sessions.
Server firewall blocking outbound
Whitelist AffClix egress IPs in your firewall rules. Check AffClix docs for current IP ranges.
Double-firing on page refresh
Store fired order IDs in a DB table. Check before firing — skip if already recorded.
Missing required parameters
Use AffClix Postback Tester in the dashboard to validate your URL before going live.
Testing Your Integration
AffClix provides a built-in postback tester and a full sandbox environment. Run these checks before going live:
- click_id appears in browser cookies after visiting the landing page
- cookie persists when navigating through the full checkout flow
- postback fires within 5 seconds of order confirmation
- conversion appears in AffClix dashboard within 10 seconds
- test passes with Safari + ad blocker active (the hardest case)
- run an idempotency test — refresh the confirmation page and verify no duplicate conversion fires
Always test on a real iOS device with Safari, not just desktop Chrome. Safari's ITP is the most aggressive tracking blocker in the field and will catch issues that Chrome testing misses.
