S2S offer tracking

Direct offer campaigns use server-to-server postbacks. Never send the postback token from browser JavaScript or a mobile client.

Launch flow

1. RapidoReach creates a signed launch session.
2. The user is redirected to the campaign URL with {click_id} replaced.
3. The advertiser stores that click ID with its signup, order, or event.
4. After server-side verification, the advertiser sends a postback.
5. RapidoReach validates ownership, deduplicates the transaction, applies caps and budget atomically, and queues the publisher reward.

Postback endpoint

Campaign Studio shows the endpoint and advertiser token in the campaign detail drawer.

POST /performance-marketing/v2/postbacks/direct
X-RapidoReach-Postback-Token: YOUR_ADVERTISER_TOKEN
Content-Type: application/json

{
  "click_id": "clk_example",
  "transaction_id": "order_12345",
  "goal_id": "qualified_purchase",
  "status": "approved",
  "occurred_at": "2026-07-19T08:30:00.000Z"
}

GET is also supported:

/performance-marketing/v2/postbacks/direct
  ?click_id={click_id}
  &transaction_id={your_unique_transaction_id}
  &goal_id={campaign_goal_id}
  &status=approved
  &token={postback_token}

Required values

Field	Requirement
click_id	Exact RapidoReach click ID
transaction_id	Globally unique advertiser transaction/event ID
goal_id	Exact milestone event ID configured in Campaign Studio
status	pending, approved, rejected, or reversed
token or header	Token for the campaign-owning advertiser

Idempotency and reversals

Retries with the same transaction, goal, and state are accepted without issuing another reward. Reusing a transaction ID for a different click or goal is rejected as an idempotency conflict.

Send status=reversed for a previously approved transaction that was refunded or invalidated. RapidoReach creates a compensating immutable ledger entry.

Testing checklist

Before requesting approval:

1. launch the Draft using a low-cap development campaign;
2. confirm the destination received the click ID;
3. send a unique approved test postback;
4. resend it and confirm it is reported as a duplicate;
5. send a bad token and confirm it is rejected;
6. pause the campaign and confirm it disappears from the offerwall;
7. resume only after tracking and content are correct.

Provider-managed campaigns show a managed-tracking notice instead of direct postback credentials.