Track has the same behavior on the server as it has from the client. The only difference is that you must specify the "user_id" when track is called from the server. Use the ID field from your database, the same you would in an identify call.
All Attribution server-side endpoints expect JSON
A note on Auth headers
Attribution app uses a HTTP Auth for all server-side functions.
Your HTTPS request header should have a blank password and the username must be your "Project ID" from Attribution app settings