Tracking setup for CPA campaigns: postbacks, deduplication, reports
In CPA, tracking is the contract made technical: the postback decides what gets paid. This guide walks through a correct setup — postbacks, deduplication, anti-fraud signals and reporting — so both sides look at the same numbers.
Why server-to-server postbacks are the standard
A browser pixel fires from the user's device — which means it dies to ad blockers, privacy settings, closed tabs and redirected flows. In affiliate marketing, where every lost conversion is a dispute, that fragility is unacceptable. The server-to-server postback solves it: when your system records the billable event, your server calls the buyer's tracker directly. No browser involved, nothing to block. This is why postbacks are the validation standard in CPA, and why "we use a pixel" is a red flag in any serious setup conversation.
The mechanics: the buyer's tracker records the click with a unique click ID, passed to your landing as a parameter. Your system stores it with the user, and when the billable event fires — deposit, confirmed order, activation — your server calls the postback URL with that click ID plus the parameters the deal needs: event type, payout or revenue value, and any qualifier your KPI definition uses. Test it end to end with a real conversion before launch: fired once, parameters intact, values matching in both systems. An untested postback is a payment dispute scheduled for later.
Click IDs and the chain of custody
Everything in CPA validation traces back to the click ID: it is the chain of custody from the traffic source to your system of record. When a conversion is disputed — rejected as fraud, claimed as duplicate — the review runs on click-level data: timestamps, parameters, the user's path. A setup that loses click IDs (stripped by redirects, not persisted through your funnel, overwritten by later clicks) cannot resolve disputes, which means they get resolved against you by default.
Check your chain before launch: click ID captured on landing, persisted through registration or checkout, attached to the billable event, and included in your validation reports. If your funnel has app installs in the middle, the same logic applies through your MMP's deferred deep linking or referral parameters — the principle is identical: an unbroken line from click to validated event, auditable in both systems.
Deduplication: counting every conversion exactly once
Duplicates arrive in predictable ways: the same user converting through an organic visit and a paid click; two paid sources both claiming the same user; your system re-firing a postback after a timeout. Left unruled, each becomes a payment dispute. The rules that prevent this are agreed before traffic: the attribution window — how long a click earns credit; the conflict rule — who wins when two sources claim the same conversion, typically first valid postback or last click within the window; and idempotency — re-fired postbacks logged but not double-counted.
Your system of record is the final arbiter: the same order ID or customer ID cannot approve twice, whatever the postbacks say. Get these rules into the written terms, because the goal is not eliminating duplicates — that never happens — but making them small, predictable and undisputed. A managed residual costs less than a monthly argument.
Anti-fraud at the tracking layer
Tracking data is the first line of fraud defense, and the signals are concrete. Timing: click-to-conversion intervals no human produces, conversion timestamps flat across the day instead of following human rhythms. Identity: device fingerprints, IPs and click IDs repeating at impossible rates. Geography: mismatches between click location, device locale and conversion GEO. Behavior: conversions with zero downstream events — no second session, no deeper action. And pattern anomalies at the source level: a placement whose approve rate or conversion timing distribution breaks from the rest of the campaign.
Detection is only half the defense; reconciliation is the other half. Conversions are matched against your system of record within the hold window — cleared deposits, confirmed orders, active subscriptions — so fraudulent conversions are caught before payment rather than disputed after. Sources that systematically produce rejections are cut from rotation. That feedback loop, run weekly, is what keeps a CPA supply chain clean; any single filter alone is not.
Reporting: what both sides should see
Reporting is the transparency layer of the deal. At minimum, you should see conversions per day with validation status, and be able to trace any conversion back to its source attributes — campaign, placement, creative, click-level parameters. The buyer should see your approval outcomes per conversion, with reasons for rejections, fast enough to optimize against. That second flow is the one advertisers most often neglect, and it is the one that determines whether quality improves or stagnates.
The granularity of source detail follows the transparency agreement for the engagement — but the principle is absolute: every quality question must have a data answer. Where did this conversion come from? Why was this one rejected? Which source's cohorts retain? If a reporting setup cannot answer these, it is not a reporting setup; it is an invoice generator. Our tracking and postbacks page describes how this loop runs in our engagements.
The pre-launch tracking checklist
Before any traffic: a tracking platform live — Keitaro, Everflow, Affise, TUNE (HasOffers), CAKE, Binom, RedTrack or an in-house equivalent. Postback URL configured with click ID, event type and KPI parameters. End-to-end test with a real conversion verified in both systems. Click ID persistence checked through your full funnel. Deduplication and attribution rules written. Validation hold defined and staffed. Rejection reasons coded, not free-text. Weekly reconciliation on the calendar.
Every item on that list is cheaper than the dispute it prevents. The KPI checklist folds these into the full twenty-point launch preparation, and the offer brief captures the setup details a partner needs to integrate with you.