What a Postback Is

A postback is a server-to-server HTTP call your affiliate network fires after a user converts on its offer — a registration, a deposit, a sale. 301.st receives that call, attaches it to the original click via a token we attach to each outgoing redirect (the _cid parameter), and lands the row in the Conversions table.

A postback source is the configuration that tells 301.st how to read a particular network's payload — which parameter carries the click ID, which one is the event type, which one is the amount, and so on. One source per network. Add a source once, and the live dashboard fills in by itself.

Quick Path: Three Ways to Add a Source

The Add source button in the page header opens a wizard with three tabs. Pick whichever you can get the data for fastest — the result is the same.

Auto-detect

When you have docs in front of you

Paste any sample postback URL the network's docs show — with their macros intact ({clickid}, {sum}, etc.) — and click Detect. If we recognise the platform, the save button creates the source with the right field mapping pre-filled.

Three outcomes: recognised (save and you're done), ambiguous (use Manual to disambiguate), or unknown (we open a support ticket and you switch to Capture or Manual).

Capture

When you have access to the network panel

Name the source, click Generate learn URL. We give you a one-time URL to paste into the network's postback field. Ask the network to fire a single test postback. As soon as it arrives we list the parameter names we saw. Click Finalize.

Useful when docs don't exist or are wrong. The captured keys are stored, but you'll still need to tell us which captured key is the click ID, which is the amount, etc. — see Field mapping below.

Manual

When you already know exactly what the network sends

Fill the form yourself. Required: name. Optional but recommended: platform (just a label that shows up in the Conversions table), outbound target URL (re-deliver each conversion to your platform with an X-301-Signature header), rate limit, attribution window, and the two map sections below.

Field Mapping (the part that actually does the work)

Networks invent their own parameter names. Your field map tells 301.st how to translate them into our canonical schema. The Edit drawer shows one row per canonical field — type the network's parameter name in the input.

click_id
The token we sent out in the redirect's _cid. Often the network calls it clickid, cid, sub1, or subid.
event_type
Which kind of conversion fired. Networks usually call it event, action, or type — and they have their own vocabulary, so see Event mapping below.
transaction_id
Unique conversion ID on the network's side. Used for deduplication — re-firing the same postback with the same transaction_id doesn't double-count.
gross_amount / gross_currency
What the user paid the operator (registration fee, deposit, purchase price). Currency is usually a separate field.
payout_amount / payout_currency
What the operator pays you for the conversion — your revenue.
external_user_id
Optional. The user's ID inside the network — useful for cross-referencing during disputes.

Leave a row blank to skip it — the field stays null on incoming conversions. Sources created via Capture currently start with an empty field map — fill it in the Edit drawer before the source is useful.

Event Mapping

Networks send their own event labels (NEW, FTD, QFTD, reg_confirmed, …) and we report on a fixed set. The event map translates one to the other.

Click Add mapping, type the operator's value on the left, pick our canonical event on the right. The seven canonical types are:

  • registration — user signed up.
  • ftd — first-time deposit.
  • qftd — qualified FTD (network's threshold met).
  • ngr — net gaming revenue (gambling).
  • deposit — any deposit beyond the first.
  • cpa — cost-per-action conversion under a flat-rate deal.
  • unknown — the catch-all for anything you didn't map.

Anything the network sends that isn't in your event map lands as unknown in the conversions table. That's fine for a few days while you tune the map, but conversions stuck on unknown don't contribute to per-event-type stats.

After Save: Secrets and URLs

Saving a source — or rotating one of its secrets — opens a one-time reveal modal. Copy what you need before closing the modal; we never show these values again from the list. You can rotate any time from the Edit drawer.

Inbound token
The shared secret the network includes when calling us. Paste it into the network's authentication header / query string field. Rotate if you suspect a leak.
Outbound HMAC
Only present if you set Outbound target URL. We sign every re-delivery with this secret in the X-301-Signature header — your platform validates it.
Postback URL
The endpoint to paste into the network's postback / S2S configuration. Includes the inbound token. Doesn't expire — you can re-display it any time from the Edit drawer.
Track URL
What the edge Worker uses internally when redirecting users. Kept for reference; you don't paste this anywhere yourself.

Reading the Live Dashboard

The top card on /postbacks shows what's happening right now. Pick a window — 15m / 1h / 24h / 7d — and watch five cards plus a per-event breakdown. The card auto-refreshes every 45 seconds while the tab is visible; switching tabs pauses it.

Clicks
Outgoing redirects we sent in the window. This is the denominator for EPC.
Conversions
Postbacks accepted in the window — already deduped by transaction_id.
Gross
Sum of gross_amount across accepted conversions — what the user paid the operator.
Payout
Sum of payout_amount — what the operator owes you.
EPC
Earnings per click — Payout / Clicks. Goes to 0 if Clicks is 0; otherwise it's the headline metric for how productive your traffic is.

The per-event-type breakdown below the cards lists each canonical event type from your map and how many fired in the window. Useful for spotting an unexpected jump in unknown — that usually means a new event label slipped past your map.

Conversions Table

Each row is a single postback we accepted. The Attribution column tells you what the platform did with it:

matched
We found the originating click via _cid and the conversion is fully attached. This is the normal happy state.
unmatched
We accepted the postback (valid token, valid signature) but couldn't find the click. Usually means the network didn't echo our _cid back in the field your map points at — fix the click_id row in field map and reproduce.
duplicate
Same transaction_id as an earlier conversion — we kept the first one and dropped this. Expected when a network retries.
expired
Postback arrived after the source's attribution_window_days. The default is 30 days — bump it on the source's Edit drawer if your offers convert later.

Click any row to expand the details drawer — canonical fields on top, raw row JSON at the bottom for debugging.

Two filter chips above the table — Attribution and Event — narrow the view. The page paginates 50 conversions at a time; the prev/next pair sits at the bottom.

Editing a Source

Open the Edit drawer from any source in the Postback sources list. It shows the same Manual fieldset (name, platform, target URL, rate limit, attribution window) plus a Secrets section.

The two Rotate buttons issue a fresh secret and surface it once — same reveal modal as during create. Update the network before the old secret expires — old and new run concurrently for a short grace period, but not forever.

Editing the field/event maps is where most of the day-to-day work lives. Add new event rows when a network ships a new event label; tweak click_id when the network changes its parameter name; delete rows you no longer need.

Troubleshooting

All my conversions land as unmatched
Most common: the network isn't echoing _cid in the parameter your map's click_id row points at. Open the conversion-details drawer on any unmatched row, inspect the raw JSON, find the parameter that carries the long base64 token, and update the field map.
No conversions at all, but the network says it's firing
Two suspects: wrong postback URL in the network panel (compare it byte-for-byte with what's in the reveal modal — the inbound token has to match), or the network is hitting a different URL than ours. Check your network's outgoing log if it has one.
Conversions show event_type: unknown
The network is sending a new event label you haven't mapped. Open the source's Edit drawer, scroll to Event mapping, add a row for the new label.
My EPC is suspiciously high or low after a window change
EPC is Payout / Clicks within the selected window. A short window can be dominated by a single large conversion; a long window evens out. Compare 24h and 7d to spot true trends.
I see tds_db_not_configured errors
The 301_tds storage isn't enabled for your region yet. The dashboard renders empty rather than blocking — usually transient during a rollout. Contact support if it persists past a day.

For Admins Only

Two extra sections appear at the bottom of /postbacks when you're signed in as an admin user — Platform signatures and Open support tickets. These let you teach Auto-detect about a new network.

Signatures are the recipes Auto-detect matches against. When an operator pastes an unrecognised URL, a ticket lands here with the URL and the parameter keys we extracted — that's your starting material for writing a new signature.

The Add signature drawer asks for an ID, a display name, the click-ID parameter list, the event/amount/currency parameter names, and two JSON-paste fields for the default field map and event map operators will get out of the box. Spend a minute looking at an existing signature's row to understand the shape before writing your first one.

Glossary

_cid
The click ID token we attach to every outbound redirect. The affiliate network has to round-trip it in their postback for attribution to work.
Attribution window
How far after the click we still accept a conversion. Default 30 days; configurable per source.
Canonical field
One of 301.st's fixed schema fields (click_id, event_type, etc.). The field map binds these to whatever names the network uses.
EPC
Earnings per click. Payout / Clicks over the selected window.
HMAC signature
Cryptographic seal we put on outbound deliveries (X-301-Signature header) so your platform can verify each conversion really came from us.
Inbound token
Per-source shared secret. The network sends it back to us so we can prove a postback is theirs.
Postback
Server-to-server HTTP call from the affiliate network telling us a user converted.
Signature
Admin-level recipe that lets Auto-detect recognise a new network's postback URL shape.

Related