Postbacks

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET_KEY = process.env.OFFERZY_SECRET_KEY; // Dashboard > Settings > Secret key

app.get("/offerzy/postback", async (req, res) => {
  const { user_id, status, reward, transaction_id, offer_id, signature } = req.query;

  // 1. Check the request came from Offerzy.
  const expected = crypto
    .createHash("md5")
    .update(`${user_id}|${reward}|${offer_id}|${SECRET_KEY}`)
    .digest("hex");
  const valid =
    typeof signature === "string" &&
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  if (!valid) return res.status(403).send("invalid signature");

  // 2. Apply each (transaction_id, status) once: retries can repeat a postback.
  //    `db` stands for your own database code.
  await db.transaction(async (tx) => {
    const isNew = await tx.recordPostbackOnce({ transaction_id, status, user_id, reward });
    if (isNew) await tx.addToBalance(user_id, Number(reward));
  });

  // 3. Any 2xx within 15 seconds marks the postback as delivered.
  res.send("ok");
});

<?php
$secretKey = getenv('OFFERZY_SECRET_KEY'); // Dashboard > Settings > Secret key

$userId        = $_GET['user_id'] ?? '';
$status        = $_GET['status'] ?? '';
$reward        = $_GET['reward'] ?? '';
$transactionId = $_GET['transaction_id'] ?? '';
$offerId       = $_GET['offer_id'] ?? '';
$signature     = $_GET['signature'] ?? '';

// 1. Check the request came from Offerzy.
$expected = md5("{$userId}|{$reward}|{$offerId}|{$secretKey}");
if (!hash_equals($expected, $signature)) {
    http_response_code(403);
    exit('invalid signature');
}

// 2. Apply each (transaction_id, status) once: retries can repeat a postback.
//    The primary key on (transaction_id, status) makes INSERT IGNORE skip repeats (MySQL).
$pdo->beginTransaction();
$insert = $pdo->prepare(
    'INSERT IGNORE INTO offerzy_postbacks (transaction_id, status, user_id, reward) VALUES (?, ?, ?, ?)'
);
$insert->execute([$transactionId, $status, $userId, $reward]);
if ($insert->rowCount() === 1) {
    $pdo->prepare('UPDATE users SET balance = balance + ? WHERE id = ?')->execute([$reward, $userId]);
}
$pdo->commit();

// 3. Any 2xx within 15 seconds marks the postback as delivered.
echo 'ok';

import hashlib
import hmac
import os
from decimal import Decimal

from flask import Flask, request

app = Flask(__name__)
SECRET_KEY = os.environ["OFFERZY_SECRET_KEY"]  # Dashboard > Settings > Secret key


@app.get("/offerzy/postback")
def offerzy_postback():
    q = request.args

    # 1. Check the request came from Offerzy.
    raw = f"{q.get('user_id', '')}|{q.get('reward', '')}|{q.get('offer_id', '')}|{SECRET_KEY}"
    expected = hashlib.md5(raw.encode()).hexdigest()
    if not hmac.compare_digest(expected, q.get("signature", "")):
        return "invalid signature", 403

    # 2. Apply each (transaction_id, status) once: retries can repeat a postback.
    #    record_postback_once and add_to_balance stand for your own database code.
    if record_postback_once(q["transaction_id"], q["status"], q["user_id"], q["reward"]):
        add_to_balance(q["user_id"], Decimal(q["reward"]))

    # 3. Any 2xx within 15 seconds marks the postback as delivered.
    return "ok"