Install Postbacks and Webhooks, Explained
A postback tells an ad network its click became an install. A webhook tells your own server. How both work, and how to receive them safely.
Ad networks and affiliate platforms pay per install, so they need to hear about each one. Your attribution provider tells them by calling a URL they give you: a postback. Point the same call at your own backend and it is a webhook.
How a click id makes the round trip
Ad network
Appy
- 01The click
GET acme.appy.to/spring?clickid=a1b2c3The network adds its click id to your link.
- 02The install
install → /spring clickid = a1b2c3The first launch is matched to that click.
- 03The postback
GET postback.network.example/install ?click_id=a1b2c3The same id goes back. The network counts a conversion.
Postback
- To an ad network
- GET, values in the URL
- Carries the network’s click id
Webhook
- To your own server
- POST, JSON body
- Carries the install, link and event
A safe receiver checks four things
Verify an Appy webhook
Node.js
import crypto from 'node:crypto';
export function verifyAppySignature(header, rawBody, secret) {
const parts = Object.fromEntries(header.split(',').map((part) => part.split('=')));
const age = Math.abs(Date.now() / 1000 - Number(parts.t));
if (!parts.t || !parts.v1 || age > 300) return false;
const expected = crypto.createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest('hex');
if (parts.v1.length !== expected.length) return false;
return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}When your endpoint is down
- timeout per request
- 10 s
- retries on 429, 5xx or timeout
- 5
- wait before the last retry
- 12 h
- delivery log
- 30 days
timeout per request
retries on 429, 5xx or timeout
wait before the last retry
delivery log
Where Appy sends installs
On the Enterprise plan, up to 10 postbacks per app, each tested from the dashboard before it goes live.
New install
signed and retried
- Affiliate or CPI networkIts click id, back
- Your backendFull JSON webhook
- Your CRMPurchases only
- Meta or Google optimisationNot supported
Read next
Questions
What is an S2S postback?
A server-to-server call that tells an ad network a click became an install, with its click id.
How do I avoid double counts?
Retries reuse the same delivery id. Ignore ids you have already processed.
How do I know a webhook is really from Appy?
Check the Appy-Signature header and reject anything older than five minutes.
Can I send postbacks to Meta or Google Ads?
Not for campaign optimisation. Postbacks suit affiliate networks, influencer tools and your own systems.
Continue exploring
Apple Ads Attribution Without an MMP
Apple tells you which campaign and keyword brought an install. One token from the app, one call from your server, no IDFA and no tracking prompt.
How to Decrypt the Meta Install Referrer on Android
Facebook and Instagram can tell your app which campaign, ad set and ad brought an install, views included. How to read it and decrypt it.
Deferred Deep Linking Without an SDK: How It Actually Works Under the Hood
You can carry link intent across an app install without embedding an attribution SDK. What actually survives the store boundary on Android and iOS, what breaks, and what each workaround costs in privacy.
Looking for something else? Browse all topics on the blog.
Send every install where it needs to go
Appy attributes installs from links, QR codes, Apple Ads, Google Ads and Meta, and sends each one on, signed and retried.