How it works
API and postbacks
We are not a walled garden. Every event we record can be pushed to your own tracker as it happens, with your own macros.
- affiliate postback API
- S2S postback forex
- affiliate API broker
Outbound: events to your tracker
Sophisticated media buyers already have a tracker, an attribution model and a way of measuring campaigns, and asking them to work inside somebody else's dashboard is asking them to run blind. So every event goes outbound with the macros they already use.
Available macros
{click_id} first-party click identifier
{event} registration | ftd | trade | withdrawal
{payout} amount accrued to you
{s1}-{s5} your own sub-IDs, as sent on the click
{symbol} instrument
{lots} volume, never a money figure
{geo} two-letter country
{device} mobile | desktop
{broker} which broker the trade closed on- RedTrack, Voluum and Binom
- The GA4 Measurement Protocol
- Meta Conversions API
- A generic webhook, for anything else
Inbound: the postback contract
The contract each broker implements against is an OpenAPI document, and the types our own intake is built from are generated out of it. That is deliberate: a document that generates the code cannot drift from the code, and a broker integrating against a stale specification is the most expensive kind of bug on this stack.
Every endpoint requires an idempotency key. A replayed postback is a no-op, and there is a test that proves it rather than a paragraph that asserts it.
| Event | What it carries |
|---|---|
| registration | Click identifier, hashed email and phone for cross-device matching, country |
| kyc | Verification outcome and timestamp |
| ftd | First deposit amount, method and country |
| trade | Symbol, volume, duration, spread captured, broker, deal ticket |
| withdrawal | Amount and timestamp, for the account lifecycle |
Keys and rotation
- API keys are shown once, revealed on demand and revocable from the portal
- Every postback is authenticated and every attempt is logged
- Outbound endpoints retry with backoff, and a failing endpoint is visible in the portal rather than silently dropped
Questions
Which trackers are supported?
RedTrack, Voluum, Binom, the GA4 Measurement Protocol, Meta Conversions API and a generic webhook for anything else. Your macros, your endpoint.
Do I get individual trade events, or only conversions?
Individual trade events, carrying the symbol, the volume, the country, the device and which broker the trade closed on. That is what makes it possible to attribute revenue to a campaign rather than only a signup.
What happens if a postback is sent twice?
Nothing. Every endpoint requires an idempotency key, and a replayed request returns the original result without creating a second accrual.
Where this comes from
Sources
Primary sources only: the regulator, the standards body, the platform vendor, the legislation, or our own agreements. Not another affiliate's summary of one.
- StandardInternet Engineering Task Force
RFC 6265: HTTP State Management Mechanism
What a cookie is at the protocol level, which is what makes the difference between a first-party and a third-party cookie concrete rather than a marketing distinction.
- LegislationOfficial Journal of the European Union
Regulation (EU) 2016/679, the General Data Protection Regulation
The lawful basis for server-side attribution, which is performance of the partner contract rather than consent, and the data minimisation rule behind the click log retention.