Media buyer tool 3 · Postback URL Tester for CPAlead

Test your CPAlead postback URL before the next conversion goes missing.

CPAlead sends an HTTP GET to the publisher's postback URL after a qualifying conversion, filling in its macros; advertisers separately call CPAlead's aff_lsr URL with the original CPAlead click ID. Below: CPAlead's postback format and macros as CPAlead's own docs give them, the ways a CPAlead postback usually breaks, and the tester, pre-filled with an example of the postback the network fires to your tracker. Edit it to match yours and run the check.

Nothing you enter leaves your browser.

CPAlead's postback format

https://example.com/postback/cpalead.php?subid={subid}&lead_id={lead_id}&campaign_id={campaign_id}&campaign_name={campaign_name}&payout={payout}&password={password}

CPAlead's click-ID macro: {subid}. Source: Postback Documentation (publisher), Advertiser tracking guide (read on November 9, 2026). Networks rename macros and some show them only inside your account; if your dashboard differs, it wins.

CPAlead macros

Macro	Meaning
{subid}	Your primary user or click reference from the tracking URL
{subid2}	Optional secondary value from the tracking URL
{subid3}	Optional tertiary value from the tracking URL
{lead_id}	Unique conversion ID; best macro for detecting retries
{campaign_id}	ID of the CPAlead campaign or offer
{campaign_name}	Name of the campaign or offer
{payout}	Payout amount for the conversion
{password}	Your saved postback password, if included in the URL
{country_iso}	Two-letter country code
{ip_address}	Visitor IP captured on the converting click
{event_payout}	Payout for the completed event on event-based offers

Parameter names on the receiving side

subid: Receiver-side name you choose for the user/click reference.
lead_id: Receiver-side name for the unique conversion ID, used to deduplicate.
payout: Receiver-side name for the payout amount.
password: Receiver-side name for the saved password your receiver must verify.
click_id: Advertiser flow: the exact CPAlead click ID, required (with id=YOUR_POSTBACK_ID).
campaign_id: Advertiser flow: recommended CPAlead campaign ID.

How a CPAlead postback usually breaks

Unsupported macros
CPAlead rejects unsupported macros when you save or test; status, click_id, signatures and reversals are not macros for this callback.
Fix: Use only lowercase macros from the documented list or aliases.
Static subid
A static subid cannot identify users; use a per-user reference for rewards.
Fix: Pass a unique per-user or per-click value in subid on the tracking URL.
Duplicate deliveries
Retries can arrive more than once, so crediting without a check double-pays; deduplicate on lead_id, safely under concurrent requests.
Fix: Store lead_id and credit each once.
Password not checked
A password saved in CPAlead does nothing on its own; your receiver must verify it.
Fix: Compare the password parameter server-side.
Firewall blocks relay
If your firewall restricts inbound traffic, CPAlead's relay IP must be allowed or callbacks never arrive.
Fix: Allowlist 34.69.179.33 for the callback route.

Test your CPAlead postback

Pre-filled with an example: CPAlead's macros in an example tracker postback (track.example.com stands for your tracker). Paste your own URL over it; the check runs in this page and fires nothing.

Your postback URL templateExactly as you gave it to the network, macros and all. If it contains an API key or token, the value is removed before anything is shown.Your offer link with its macros (optional)The link your tracker sends visitors to. It lets the tester check the click ID goes out and comes back in the same field.

Your network's click-ID macroThe macro the network fills with the click ID you sent it. It also tells the tester which syntax the network uses.

My funnel has more than one event (e.g. registration, then deposit)Then the postback needs a status or event-type parameter.A real click ID from your tracker (optional)Used only in the test-fire URL, so a test lands on a click you can find.

Want me to trace one real campaign?

This tool checks the postback URL and offer link you pasted from what you typed. It can't see your ad accounts, tracker, network or live traffic. If the result shows gaps, I'll look at one real campaign for free: I trace it from ad click to payout and back, and within 48 hours I send you a written report on where money or data leaks silently, the fix for each, and the tests that prove it's fixed.

In the review I fire a test conversion end to end on one real campaign and check it lands once, with the right payout, in your tracker and in your traffic source. You get the fix for every place it doesn't.

Request the free spend-path review

Shilpa Goel, [email protected]

This is an engineering checklist, not a security audit, legal, compliance or investment advice.

Not affiliated with or endorsed by Meta, Google, TikTok or any network or tracker named here.