Transparent redirect documentation

How a Postbackly tracking link behaves, request by request. For reporting conversions, see the postback API.

At a glance

Tracking domain: go.postbackly.click (HTTPS)
Transparency parameter: url: the next hop is always its value
Parameter we add: pbclid only (our click ID)
Redirect: one 302 Found, straight to the destination, no intermediate domains
Paths: every path on the tracking domain follows url, including /
Secondary parameter: none: url is always respected

Link format

https://go.postbackly.click/l/<link_key>?sub1=fb_campaign_12&sub2=adset_7&url=https%3A%2F%2Fshop.example.com%2Fsale

Part	What it does
`/l/<link_key>`	Identifies one offer and publisher pair, so the click is credited to them. It never decides where the visitor goes.
`sub1` to `sub5`	Optional labels chosen by the publisher (campaign, ad set, placement…), up to 255 characters each. Recorded for reports, never sent to the destination.
other parameters	For example `gclid` or `campaignid` on the tracking URL. Recorded with the click, never sent to the destination.
`url`	The destination, URL-encoded. Required: it is the only thing that decides the redirect.

Your dashboard builds each link with the offer’s landing page already in url. A publisher may point url to a deeper page. If the offer has Registered host only turned on, a destination on any other host is refused with 403; it is never replaced with the registered landing page.

The url parameter

The tracker always redirects to the value of url. There is no destination stored on our servers that could be used instead, and the landing page saved on the offer is never substituted for it.
The name is case-sensitive (url, not URL). If url appears more than once, the first one is used.
The value must be URL-encoded, as Google’s {lpurl} already is. It is decoded once. An unencoded & inside the destination would end the value early, and the rest would become tracker parameters.
After decoding, it must be an absolute http:// or https:// URL of at most 4,096 characters, without a user name or password, and not pointing to a local or private network address.

Every path is transparent

Any path on go.postbackly.click with a url parameter redirects to that value: /l/<link_key>, /, /l/ with a key that does not exist, or any other path. A request without a valid link key is redirected in exactly the same way; it is simply not credited to any offer or publisher.

GET, POST and HEAD receive the same 302. The tracker is served over HTTPS; a request to http:// first gets a 301 to the same URL on https://. The redirect response carries no Referrer-Policy header, so we do not change what referrer the browser sends to the destination.

The pbclid parameter

Parameter	Value	Purpose
`pbclid`	16 random characters from `A–Z a–z 0–9 - _` (base64url), new for every click	Our click ID. The landing page stores it with the order and sends it back in the postback.

pbclid is the only parameter Postbackly adds, and it is specific to our service. It is appended at the end of the destination’s query string, before any #fragment, using ? or & as needed. Nothing else in the destination is changed: parameter order, encoding, empty parameters, {macros}, gclid, gad_source, UTM tags and nested tracker URLs stay character for character. If the destination already has a pbclid, it is kept and ours is added after it.

We never add UTM tags, affiliate IDs, sub IDs or any other foreign parameter. Parameters on the tracking URL itself, including sub1 to sub5 and a gclid added by Google Ads, are recorded and never copied to the destination. The only other change: characters that are not allowed in an HTTP header, such as spaces or non-ASCII letters, are percent-encoded.

Examples

Publisher link with sub IDs; the destination already has its own parameters

GET https://go.postbackly.click/l/Xk29fQ7aLm?sub1=fb_campaign_12&sub2=adset_7&url=https%3A%2F%2Fshop.example.com%2Fsale%3Futm_source%3Dpartner%26gclid%3DCj0KCQiA

HTTP/1.1 302 Found
Location: https://shop.example.com/sale?utm_source=partner&gclid=Cj0KCQiA&pbclid=Rk7pW2xQa9Lm_3Tc

sub1 and sub2 are recorded, not forwarded. utm_source and gclid were inside url, so they reach the landing page unchanged.

Destination with a fragment and no query

GET https://go.postbackly.click/l/Xk29fQ7aLm?sub1=tiktok_03&url=https%3A%2F%2Fshop.example.com%2Fkhoa-hoc%23dang-ky

HTTP/1.1 302 Found
Location: https://shop.example.com/khoa-hoc?pbclid=Rk7pW2xQa9Lm_3Tc#dang-ky

Root path, no link key

GET https://go.postbackly.click/?url=https%3A%2F%2Fshop.example.com%2F

HTTP/1.1 302 Found
Location: https://shop.example.com/?pbclid=Rk7pW2xQa9Lm_3Tc

Macros and empty parameters are kept verbatim

GET https://go.postbackly.click/l/Xk29fQ7aLm?url=https%3A%2F%2Fshop.example.com%2Fp%3Fref%3D%7Bclickid%7D%26empty%26a%3D1

HTTP/1.1 302 Found
Location: https://shop.example.com/p?ref={clickid}&empty&a=1&pbclid=Rk7pW2xQa9Lm_3Tc

Nested trackers

The destination may be another click tracker. We redirect to it unchanged (with pbclid added at the end of its query), and that tracker then follows its own transparency parameter. Under the Google Ads guidelines, every nested tracker must be certified on its own; its vendor is responsible for its application.

Encode the whole nested URL, including its own encoded parameter. Correct:

GET https://go.postbackly.click/l/Xk29fQ7aLm?url=https%3A%2F%2Ftrack.partner.example%2Fclick%3Fdest%3Dhttps%253A%252F%252Fshop.example.com%252Fsale

HTTP/1.1 302 Found
Location: https://track.partner.example/click?dest=https%3A%2F%2Fshop.example.com%2Fsale&pbclid=Rk7pW2xQa9Lm_3Tc

Wrong: unencoded, the destination stops at the first &, so x=1 becomes a tracker parameter and the nested tracker receives a broken dest:

https://go.postbackly.click/l/Xk29fQ7aLm?url=https://track.partner.example/click?dest=https://shop.example.com/sale&x=1

Errors and blocking

A refused request gets an error page and is never redirected anywhere else.

Status	When
302	`url` is valid and not blocked. Location is the `url` value plus `pbclid`.
400	`url` is not an absolute `http`/`https` URL; contains a user name or password (`https://user:pass@…`); points to `localhost`, a `.local` or `.internal` name or a private network address; is longer than 4,096 characters; or is encoded twice (`https%253A…`).
403	The destination host is on our abuse blocklist; the link, its offer or the account has been suspended; or the offer accepts only its registered host and `url` points to a different host.
404	No `url` parameter, on any path other than `/`. An information page, no redirect.
200	https://go.postbackly.click/ without `url`: a page saying who operates the tracker and how to report abuse.

We block hosts that are reported or found to serve phishing, malware or other harmful content. Report a link that abuses our tracker to abuse@postbackly.click.

Bots and link previews

Requests from known bots and automated tools (AdsBot-Google and other Google crawlers, link previews from chat apps, uptime monitors) and HEAD or OPTIONS requests receive the same redirect as anyone else. They are only marked as bots, so they are left out of click counts, CR and EPC. Postbackly never changes the destination by visitor, device, country or time, and does not rotate between destinations.

Google Ads

Use a tracking template, so your ad’s final URL stays your landing page and Google fills {lpurl} with it, already encoded:

https://go.postbackly.click/l/YOUR_LINK_KEY?sub1={campaignid}&sub2={adgroupid}&sub3={keyword}&gclid={gclid}&url={lpurl}

Copy the link key of the offer and publisher pair from your dashboard and replace YOUR_LINK_KEY.
In Google Ads, open the Tracking section of the account, campaign or ad group and paste it into Tracking template.
Click Test: Google should load your landing page. Then save.

You may remove any parameter except url={lpurl}. gclid={gclid} on the tracking URL is recorded with the click for your reference; Google adds its own gclid to the landing page as usual.

Parallel trackingWith Google Ads parallel tracking, the default for most campaigns, the visitor goes straight to your final URL while Google calls the tracking URL in the background. The click is recorded (with the gclid from gclid={gclid} in the template), but the landing page does not receive pbclid. In that case, send the postback with the gclid your landing page received instead of click_id: it is matched to the recorded click. See postback parameters.

Data recorded per click

Time, IP address, user agent, referrer, accept-language header, link key, sub1 to sub5, other tracking URL parameters, destination URL, the pbclid we generated and the bot mark. Kept for 90 days. The tracker sets no cookies, runs no scripts and does not fingerprint browsers. Details in our privacy policy.