Flutter offerwall plugin. One Dart API, Android and iOS.

dependencies:
  moonetix_offerwall:
    hosted: https://moonetix.com/pub
    version: ^2.0.0

<?php
// POST /api/moonetix/session: a fresh token for the signed-in user
$user = current_user();
if (!$user) {
    http_response_code(401);
    exit;
}
 
$key = getenv('MOONETIX_API_KEY');
$ch  = curl_init('https://api.moonetix.com/v1/session');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => http_build_query(['user_id' => (string)$user->id]),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 10,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $key],
]);
$data = json_decode((string)curl_exec($ch), true);
$code = (int)curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
 
header('Content-Type: application/json');
if ($code === 201 && !empty($data['token'])) {
    echo json_encode(['token' => $data['token']]);
    exit;
}
http_response_code($code === 403 ? 403 : 503);
echo json_encode(['error' => 'offerwall_unavailable']);

// POST /api/moonetix/session: a fresh token for the signed-in user
app.post('/api/moonetix/session', requireLogin, async (req, res) => {
  const r = await fetch('https://api.moonetix.com/v1/session', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.MOONETIX_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ user_id: String(req.user.id) }),
    signal: AbortSignal.timeout(10000),
  });
  const data = await r.json().catch(() => ({}));
  if (r.status === 201 && data.token) {
    return res.json({ token: data.token });
  }
  const status = r.status === 403 ? 403 : 503;
  res.status(status).json({ error: 'offerwall_unavailable' });
});

# POST /api/moonetix/session: a fresh token for the signed-in user
@app.post("/api/moonetix/session")
@login_required
def moonetix_session():
    key = os.environ["MOONETIX_API_KEY"]
    r = requests.post(
        "https://api.moonetix.com/v1/session",
        data={"user_id": str(current_user.id)},
        headers={"Authorization": f"Bearer {key}"},
        timeout=10,
    )
    data = r.json()
    if r.status_code == 201 and data.get("token"):
        return {"token": data["token"]}
    status = 403 if r.status_code == 403 else 503
    return {"error": "offerwall_unavailable"}, status

void main() {
  WidgetsFlutterBinding.ensureInitialized();
  Moonetix.init('YOUR_APP_ID');
  runApp(const MyApp());
}
 
Moonetix.events.listen((MoonetixEvent event) {
  switch (event) {
    case MoonetixOpened():
      break;
    case MoonetixClosed():
      refreshBalance();
    case MoonetixErrorEvent(:final MoonetixError error):
      debugPrint('${error.code.name}: ${error.message}');
  }
});
 
await Moonetix.open(token);

https://yoursite.com/postback?user={user_id}&tx={transaction_id}&status={status}&reward={reward}&hash={hash}

<?php
$tx     = $_GET['tx'] ?? '';
$userId = $_GET['user'] ?? '';
$reward = $_GET['reward'] ?? '';
$status = $_GET['status'] ?? '';
 
$secret   = getenv('MOONETIX_POSTBACK_SECRET');
$expected = hash_hmac('sha256', "$tx:$userId:$reward:$status", $secret);
if (!hash_equals($expected, $_GET['hash'] ?? '')) {
    http_response_code(403);
    exit;
}
 
if ($status === '1') {
    credit_once($userId, $tx, $reward);   // once per transaction ID
} elseif ($status === '2') {
    reverse_if_credited($userId, $tx, $reward);
}
http_response_code(200);

const crypto = require('crypto');
 
app.get('/postback', (req, res) => {
  const { tx, user, reward, status, hash } = req.query;
  const secret = process.env.MOONETIX_POSTBACK_SECRET;
  const expected = crypto.createHmac('sha256', secret)
    .update(`${tx}:${user}:${reward}:${status}`)
    .digest('hex');
  const valid = typeof hash === 'string'
    && hash.length === expected.length
    && crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(expected));
  if (!valid) return res.sendStatus(403);
 
  if (status === '1') creditOnce(user, tx, reward);   // once per transaction ID
  if (status === '2') reverseIfCredited(user, tx, reward);
  res.sendStatus(200);
});

import hmac, hashlib, os
from flask import request, abort
 
@app.get("/postback")
def postback():
    a = request.args
    parts = [a.get(k, "") for k in ("tx", "user", "reward", "status")]
    msg = ":".join(parts)
    secret = os.environ["MOONETIX_POSTBACK_SECRET"].encode()
    expected = hmac.new(secret, msg.encode(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, a.get("hash", "")):
        abort(403)
 
    if a.get("status") == "1":
        credit_once(a["user"], a["tx"], a["reward"])   # once per transaction ID
    elif a.get("status") == "2":
        reverse_if_credited(a["user"], a["tx"], a["reward"])
    return "", 200