Conversion integrity

Start with a bound click#

Use the click URL returned by the accepted offer attempt. Each proof binds the offer version, publisher, placement, opaque user, device and install hints, issued time and event terms. Open it once. Keep the click ID unchanged through your advertiser or measurement partner. Install, engagement, purchase and web windows are pinned when the click is created.

Sign the original request#

Sign the exact method, path, query and body bytes with your integration key. Send the key ID, Unix timestamp and a fresh nonce. Timestamps have a five-minute tolerance. A retry keeps the provider event ID and payload; use a fresh timestamp and nonce after the transport window. A durable receipt confirms delivery, while conversion approval is a separate step.

canonical = timestamp + "\n" + nonce + "\n"
          + method.toUpperCase() + "\n"
          + rawPathAndQuery + "\n"
          + sha256(rawBody).toLowerCase()

signature = "v1=" + hmacSha256(secret, canonical)

• Postback transport

Connect your measurement partner#

AppsFlyer, Adjust, Branch, Singular and Kochava require an account-approved field map and authentication profile. Their callback formats and macros differ. Static-header authentication and signatures without a replay envelope enter the low-trust hold path. Aggregate attribution cannot approve an individual user's reward. Confirm your connector's admission and authentication status before sending traffic.

Attach app and installation evidence#

Request a one-use server challenge bound to the app, installation, click and request digest. Obtain a Play Integrity token on Android or an App Attest attestation or assertion on iOS, then submit it to your server for verification. DeviceCheck is a fallback signal. Android install-referrer data must contain exactly one matching krin_click_id. Hardware-backed signing keys protect SDK requests; keep shared integration and reward secrets on your backend.

Understand a hold#

A held conversion creates no publisher reward callback. Low-trust transport has a 72-hour hold unless the advertiser confirms first. Device, timing, source-rate and geo anomalies require an explicit advertiser decision. Evidence records the signal, source, threshold and rules version. A score is a screening measure, not proof of fraud. Publisher quality includes the cohort size so an empty cohort is never shown as perfect quality.

Resolve a rejection or appeal#

Unknown, expired, reused or mismatched clicks cannot become payable. Signature failures reject transport. Revenue below the pinned payout rejects the economic obligation. An advertiser can appeal a conversion decision with a reason and a stable appeal ID. A pending appeal does not release a reward. Reversals link to the original conversion and append compensating ledger entries and signed publisher callbacks.

Verify publisher rewards#

Verify the callback signature and timestamp before parsing JSON. Check the placement and signing key, retain nonce fingerprints, and deduplicate transactionId in the same transaction as the user credit. A reversal must reference an original credit with matching user, placement, offer, event and currency, and cannot exceed its remaining amount. Return success only after a durable receipt.

// Publisher server only
const receiver = new PublisherRewardReceiver(durableStore, resolveScopedKey);
const receipt = await receiver.receive({ method, path: rawPathAndQuery, body: rawBytes, headers });
// Send the authenticated publisher credit receipt after your ledger commits.

• Publisher credit receipt