Offerwall for any website. Link, iframe, or button.

<?php
// Build the link on your server, for the signed-in user
$hash = hash_hmac('sha256', $userId, $linkHashSalt);
$url  = 'https://wall.moonetix.com/' . $appId
      . '?user_id=' . rawurlencode($userId) . '&hash=' . $hash;

// Build the link on your server, for the signed-in user
const crypto = require('crypto');
const hash = crypto.createHmac('sha256', linkHashSalt)
  .update(String(userId))
  .digest('hex');
const url = `https://wall.moonetix.com/${appId}`
  + `?user_id=${encodeURIComponent(userId)}&hash=${hash}`;

# Build the link on your server, for the signed-in user
import hmac, hashlib
from urllib.parse import quote
 
uid = str(user_id)
hash = hmac.new(link_hash_salt.encode(), uid.encode(), hashlib.sha256).hexdigest()
url = f"https://wall.moonetix.com/{app_id}?user_id={quote(uid)}&hash={hash}"

<iframe title="Offerwall"
  src="https://wall.moonetix.com/{APP_ID}?user_id={USER_ID}&hash={HASH}"
  style="border:0;width:100%;height:100vh"></iframe>

<script src="https://wall.moonetix.com/embed.js" async
  data-button-url="https://wall.moonetix.com/{APP_ID}?user_id={USER_ID}&hash={HASH}"
  data-button-text="Earn rewards"
  data-button-color="#004ABB"
  data-button-position="right"></script>

<a href="https://wall.moonetix.com/{APP_ID}?user_id={USER_ID}&hash={HASH}"
   data-moonetix-open>Earn rewards</a>
<script src="https://wall.moonetix.com/embed.js" async></script>

https://wall.moonetix.com/{APP_ID}?user_id={USER_ID}&hash={HASH}&sub1=homepage

https://yoursite.com/postback?user={user_id}&tx={transaction_id}&status={status}&reward={reward}&hash={hash}

<?php
$tx     = $_GET['tx'] ?? '';
$userId = $_GET['user'] ?? '';
$reward = $_GET['reward'] ?? '';
$status = $_GET['status'] ?? '';
 
$secret   = getenv('MOONETIX_POSTBACK_SECRET');
$expected = hash_hmac('sha256', "$tx:$userId:$reward:$status", $secret);
if (!hash_equals($expected, $_GET['hash'] ?? '')) {
    http_response_code(403);
    exit;
}
 
if ($status === '1') {
    credit_once($userId, $tx, $reward);   // once per transaction ID
} elseif ($status === '2') {
    reverse_if_credited($userId, $tx, $reward);
}
http_response_code(200);

const crypto = require('crypto');
 
app.get('/postback', (req, res) => {
  const { tx, user, reward, status, hash } = req.query;
  const secret = process.env.MOONETIX_POSTBACK_SECRET;
  const expected = crypto.createHmac('sha256', secret)
    .update(`${tx}:${user}:${reward}:${status}`)
    .digest('hex');
  const valid = typeof hash === 'string'
    && hash.length === expected.length
    && crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(expected));
  if (!valid) return res.sendStatus(403);
 
  if (status === '1') creditOnce(user, tx, reward);   // once per transaction ID
  if (status === '2') reverseIfCredited(user, tx, reward);
  res.sendStatus(200);
});

import hmac, hashlib, os
from flask import request, abort
 
@app.get("/postback")
def postback():
    a = request.args
    parts = [a.get(k, "") for k in ("tx", "user", "reward", "status")]
    msg = ":".join(parts)
    secret = os.environ["MOONETIX_POSTBACK_SECRET"].encode()
    expected = hmac.new(secret, msg.encode(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, a.get("hash", "")):
        abort(403)
 
    if a.get("status") == "1":
        credit_once(a["user"], a["tx"], a["reward"])   # once per transaction ID
    elif a.get("status") == "2":
        reverse_if_credited(a["user"], a["tx"], a["reward"])
    return "", 200