Postback S2S

When to use it#

Server-to-server postback is the most reliable way to record a conversion, because it does not depend on anything happening in the browser. Cases where it is the right answer:

• Checkout on a third-party domain, where the cookie does not survive
• Conversion confirmed after the order — payment approved, bank slip cleared, subscription activated
• Conversion that happens off-site: phone, messaging app, physical store, CRM
• An advertiser that cannot or will not install third-party JavaScript
• Environments with aggressive script blocking

The postback URL#

The Moclick team provides the full URL and the campaign token. The token is generated automatically per campaign and is never reused across campaigns.

https://bridge.moclick.com.br/wp-json/moclick/v1/postback
  ?slug=YOUR-CAMPAIGN
  &token=YOUR-TOKEN
  &click_id={CLICK_ID}
  &txid={TXID}
  &value={VALUE}

How the advertiser gets the click_id#

The identifier has to reach the advertiser’s backend and be stored alongside the order. If the global tag is installed it is already in a cookie — read it server-side when writing the order:

// The Moclick team tells you the cookie name for your campaign.
$click_id = $_COOKIE[MOCLICK_COOKIE] ?? '';

// Store it with the order, to use when the conversion is confirmed
save_order_meta($order_id, 'moclick_click_id', $click_id);

Without the global tag, capture the identification parameter on entry and persist it in the session. The Moclick team tells you which parameter the campaign uses.

Example call#

curl -sS -G "https://bridge.moclick.com.br/wp-json/moclick/v1/postback" 
  --data-urlencode "slug=my-campaign" 
  --data-urlencode "token=YOUR_TOKEN" 
  --data-urlencode "click_id=abc-123" 
  --data-urlencode "txid=ORDER-9001" 
  --data-urlencode "value=249.90"

$url = 'https://bridge.moclick.com.br/wp-json/moclick/v1/postback?'
    . http_build_query([
        'slug'     => 'my-campaign',
        'token'    => MOCLICK_TOKEN,
        'click_id' => $click_id,
        'txid'     => $order_number,
        'value'    => number_format($total, 2, '.', ''),
    ]);

$res = wp_remote_get($url, ['timeout' => 5]);

if (is_wp_error($res) || wp_remote_retrieve_response_code($res) !== 200) {
    // Queue for a retry — see "Retries" below
}

const url = new URL("https://bridge.moclick.com.br/wp-json/moclick/v1/postback");
url.search = new URLSearchParams({
  slug: "my-campaign",
  token: process.env.MOCLICK_TOKEN,
  click_id: clickId,
  txid: orderNumber,
  value: total.toFixed(2)
});

const res = await fetch(url, { signal: AbortSignal.timeout(5000) });
if (!res.ok) throw new Error(`postback failed: ${res.status}`);

import requests

r = requests.get(
    "https://bridge.moclick.com.br/wp-json/moclick/v1/postback",
    params={
        "slug": "my-campaign",
        "token": MOCLICK_TOKEN,
        "click_id": click_id,
        "txid": order_number,
        "value": f"{total:.2f}",
    },
    timeout=5,
)
r.raise_for_status()

Responses#

One detail that saves confusion: 200 OK confirms receipt, not necessarily a write. A request with no click_id, or one for a campaign that does not use Moclick’s own measurement, answers OK without recording anything — the same silent policy as the other endpoints. When integrating, confirm in the dashboard that the event actually showed up.

Retries and idempotency#

The call is idempotent on the click_id + txid pair: repeating the same request never creates a duplicate conversion. That makes retrying safe, and retrying is recommended.

Token security#

• Keep the token on the server. Never in JavaScript, HTML or a mobile app
• Store it in an environment variable or a secrets vault, not in the repository
• One token per campaign: compromising one does not expose the others
• Whoever holds the token can insert conversions into that campaign — treat it as a credential