What is an offerwall postback URL?

A postback URL is a server-to-server (S2S) HTTP request sent by the offerwall platform to your backend when a user completes an offer. It carries transaction data — user ID, offer ID, payout amount, and a signature — so your server can validate and credit the reward without trusting the client.

How do I test my postback endpoint without real offers?

Use the Perkox postback simulator in the publisher dashboard. It sends a signed test request to your endpoint with dummy transaction data. You can also use curl to replay known-good payloads and verify your signature validation and idempotency logic handle them correctly.

Should I always return HTTP 200 from my postback endpoint?

Return HTTP 200 only when you have successfully processed and stored the transaction. Return a non-200 status (e.g., 500 or 503) if a transient error occurs so the platform retries. Never return 200 for a duplicate you intentionally skipped — return 200 only for successful processing, and handle duplicates with idempotency keys.

What is the difference between MD5 and SHA256 postback signatures?

MD5 is faster but cryptographically weaker; SHA256 is the modern standard and recommended for all new integrations. Perkox supports both for backward compatibility, but SHA256 with HMAC provides the strongest guarantee that the postback originated from Perkox and was not tampered with in transit.

How do I prevent duplicate rewards from postback retries?

Store the unique transaction ID from each postback in a database table with a unique constraint. Before crediting a reward, check whether the transaction ID already exists. If it does, return HTTP 200 without re-crediting. This idempotency pattern ensures retries never result in double-payments.

The Complete Offerwall Postback Guide: Setup, Testing, and Troubleshooting (2026)

The Complete Offerwall Postback Guide: Setup, Testing, and Troubleshooting (2026) | Perkox