Skip to content
PubCrypto/Publisher resources
Publisher Integration Guide

Integration Docs

Embed the offerwall, receive signed postbacks, credit your members β€” and understand every commission calculation end to end.

On this page
Introduction

How it works

PubCrypto connects offer providers with your website. When your members complete offers, you earn commission in USDT and your members receive points or coins in your own system.

Member opens iframeCompletes offerOffer provider verifiesPubCrypto receives postbackSite B credits the member
Get started

Quick Start

01
Create your App

Register, then add your website via App/Website β†’ Add New App (Terms β†’ App Info β†’ Config β†’ Submit).

02
Get approved

An admin reviews your app. On approval you receive an embed key and a forward secret.

03
Create a signed iframe

Your server requests a one-time iframe URL using the publisher API key.

04
Receive postbacks

When a member completes a task, we POST a signed postback to your server so you can credit them.

Financials

Money Flow: A β†’ B

The project has two different settlement flows: Offerwall and PubCrypto Link. Their formulas are not interchangeable. The calculations below match the fields and transactions used by the current backend.

1. Offerwall
Offer Provider
Provider
Confirms conversion Sends Payout
PubCrypto
Platform
Credits 100% payout to publisher Creates signed postback
Your Website
Publisher
Receives USDT Verifies and processes reward_pb
Member
End user
Receives coins/points in Website B
Example β€” $0.003 payout, 80% member share, 25,000 Coins/USD
RecipientAmountNote
Offer Provider β†’ PubCrypto$0.003 USDTOriginal Payout
PubCrypto β†’ Publisher+$0.003 USDTPublisher Amount = Payout; Platform Amount = 0
PubCrypto β†’ Website Bpayout_pb = $0.0024$0.003 Γ— 80%; member-side USD value
Website B β†’ Memberreward_pb = 60 Coins$0.0024 Γ— 25,000; credit only after signature verification
2. PubCrypto Link

For PubCrypto Link, the Admin-configured reward is the Publisher's full USD credit. Each app sets pubcrypto_link_member_percent for a separate member reward; it does not reduce Publisher earnings.

PubCrypto Link formula
member_Payout       = admin_reward_usd Γ— pubcrypto_link_member_percent / 100
publisher_credit_usd = admin_reward_usd
reward_pb           = member_Payout Γ— exchange_rate
Example β€” $0.010 task, 50% member share, 1,000 Coins/USD
ComponentValueResult
Admin reward$0.010Publisher receives this full amount
Member payout$0.005$0.010 Γ— 50%
Website B β†’ Member5 Coins$0.005 Γ— 1,000
PubCrypto β†’ Publisher+$0.010 USDTEquals Admin reward
Auto approve: publisher credit happens in the same transaction and Website B receives status=1. Manual approve: starts at status=0 with no publisher credit; admin approval credits the publisher and sends status=1. Rejection sends status=2.
Referral commission currently applies to Offerwall conversions only: referral_commission = Publisher Amount Γ— referral_percent / 100. It is an additional credit and does not reduce publisher payout; chargebacks reverse it. PubCrypto Link does not currently generate referral commission.
For an Offerwall chargeback, the backend writes a negative ledger entry, reverses referral commission, and sends a signed status=2 postback so Website B can subtract the original transaction's reward_pb.
Step 1

Embed the Iframe

You can embed the Offerwall in 2 ways. New apps use Signed by default; Legacy is only for websites that cannot yet integrate the server API.

1
Signed β€” more secure
Recommended

Website B's backend uses the publisher API key to create a member-specific iframe_url. It contains a short-lived, single-use token and never exposes the API key to the browser.

POST/api/publisher/embed-tokens
cURL
curl --request POST \
  "https://pub.cryptolinkforearn.com/api/publisher/embed-tokens" \
  --header "Authorization: Bearer YOUR_PUBLISHER_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "site_key": "YOUR_EMBED_KEY",
    "sub_id": "MEMBER_ID",
    "origin": "https://website-b.com",
    "theme": "dark"
  }'
201 Response
{
  "iframe_url": "https://pub.cryptolinkforearn.com/offerwall/?embed_token=owe_...&theme=dark",
  "expires_in": 60
}
HTML
<iframe
  data-pubcrypto-offerwall
  src="IFRAME_URL_FROM_YOUR_SERVER"
  title="Offerwall"
  width="100%"
  height="800"
  frameborder="0"
  style="display:block;width:100%;max-width:100%;border:0"
  sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox"
  referrerpolicy="no-referrer"
></iframe>
<script>
(function () {
  window.addEventListener("message", function (event) {
    if (event.origin !== "https://pub.cryptolinkforearn.com" || !event.data || event.data.type !== "pubcrypto:offerwall-resize") return;
    var height = Math.round(Math.min(5000, Math.max(360, Number(event.data.height) || 800)));
    var frames = document.querySelectorAll("iframe[data-pubcrypto-offerwall]");
    for (var index = 0; index < frames.length; index += 1) {
      if (frames[index].contentWindow === event.source) frames[index].style.height = height + "px";
    }
  });
}());
</script>
2
Legacy β€” less secure
Legacy

Legacy embeds directly with site_key + sub_id and does not use a one-time signed embed token. It is easier to integrate, but site_key and sub_id are visible in the URL.

Legacy iframe
<iframe
  data-pubcrypto-offerwall
  src="https://pub.cryptolinkforearn.com/offerwall/?site_key=YOUR_EMBED_KEY&amp;sub_id=MEMBER_ID"
  title="Offerwall"
  width="100%"
  height="800"
  frameborder="0"
  style="display:block;width:100%;max-width:100%;border:0"
  sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox"
  referrerpolicy="no-referrer"
></iframe>
<script>
(function () {
  window.addEventListener("message", function (event) {
    if (event.origin !== "https://pub.cryptolinkforearn.com" || !event.data || event.data.type !== "pubcrypto:offerwall-resize") return;
    var height = Math.round(Math.min(5000, Math.max(360, Number(event.data.height) || 800)));
    var frames = document.querySelectorAll("iframe[data-pubcrypto-offerwall]");
    for (var index = 0; index < frames.length; index += 1) {
      if (frames[index].contentWindow === event.source) frames[index].style.height = height + "px";
    }
  });
}());
</script>
Note: Apps use Signed by default. To switch to Legacy mode, please message the Admin and provide the App name or domain. Legacy access is granted temporarily per App.
URL Parameters
ParameterRequiredDescription
embed_tokenYesDefault secure mode. A one-time token returned by POST /api/publisher/embed-tokens. It expires after 60 seconds.
site_keyNoLegacy exception only. Accepted when an admin grants a temporary legacy window to this specific app.
sub_idNoLegacy exception only. In signed mode the member id is bound inside embed_token.
Security: only Website B's backend holds the publisher API key. Provider campaign URLs never reach the DOM; every click exchanges a campaign token for a one-time redirect token. A conversion without a valid redirect is stored as risk_held and is not credited.
What is Legacy? It is the old iframe method using site_key + sub_id without a one-time signed embed token. Origin protection is weaker; the click gateway and anti-automation checks remain active.
Step 2

What is a Postback?

Postback, also called an S2S callback, is an HTTP request sent directly from PubCrypto to your server whenever a member completes a task. It tells you which member to credit even after their browser is closed.

PubCrypto sends an HTTP POST using application/x-www-form-urlencoded to the Postback URL configured for your app. The reward_pb value already includes your Member Percent, and every postback is MD5-signed for verification.

Provider β†’ PubCryptoPubCrypto records conversionCalculate reward_pb = reward Γ— Member Percent%POST β†’ your server
We wait up to 60 seconds and expect exactly ok. If your server errors or times out, PubCrypto retries with backoff (up to 8 attempts, exponential delay).
Reference

Postback Parameters

When a member completes an offer, PubCrypto signs the fields below and sends them as application/x-www-form-urlencoded to your app's postback_url. Always verify signature before processing any field.
ParameterDescriptionExample
subIdThe member id you passed in the iframe URL. Use this to identify who to credit.user123
transIdUnique transaction ID. Skip duplicates to avoid double-crediting.XX-12345678
offer_nameHuman-readable name of the completed offer (informational).Airdrops Engine
offer_typeOffer category (informational).ptc
reward_pbPoints/coins to credit (already multiplied by Member Percent). Add or subtract this value.1.25
reward_nameYour configured currency name (Coins, Points…).Coins
payout_pbUSD value of the reward (informational). payout_pb = reward_pb / reward_value.0.100000
status
0 = pending(record only, do not credit)1 = credit(add reward_pb)2 = chargeback(subtract reward_pb)
0
clicked_atISO timestamp of first click (for fraud analytics).2026-07-14 10:23:45
completed_atISO timestamp when the offer was completed.2026-07-14 10:31:02
ipIP address of the member at completion time.192.168.1.0
country2-letter country code derived from IP.US
signatureMD5 verification hash: md5(subId + transId + reward_pb + secretKey). Always verify before crediting.17b4e2a70d6efe6796dd4c5507a9f9ab
Signature uses the standard formula β€” reuse your existing verification code:
md5( subId + transId + reward_pb + secretKey )
secretKey is your app's Forward Secret β€” not the API key.
Step 2 β€” code

Verify & Credit

Process each postback in 4 steps: (1) verify the MD5 signature, (2) deduplicate transId, (3) record pending or credit/charge back reward_pb, and (4) return exactly ok.

postback.php
<?php
// Your Forward Secret (from App settings page). Keep it private.
$secret = "YOUR_FORWARD_SECRET";

// Read the postback parameters sent by PubCrypto to your server.
$subId       = $_REQUEST['subId']        ?? '';
$transId     = $_REQUEST['transId']      ?? '';
$reward      = $_REQUEST['reward_pb']    ?? '';
$rewardName  = $_REQUEST['reward_name']  ?? '';
$payout      = $_REQUEST['payout_pb']    ?? '';
$status      = $_REQUEST['status']       ?? '';
$clickedAt   = $_REQUEST['clicked_at']   ?? '';
$completedAt = $_REQUEST['completed_at'] ?? '';
$ip          = $_REQUEST['ip']           ?? '';
$country     = $_REQUEST['country']      ?? '';
$signature   = $_REQUEST['signature']    ?? '';

// 1) Verify the signature: md5(subId + transId + reward_pb + secretKey).
if (md5($subId . $transId . $reward . $secret) !== $signature) {
    http_response_code(403);
    exit("ERROR: signature doesn't match");
}

// 2) Prevent double-crediting β€” skip if this transId was already handled.
if (!isNewTransaction($transId)) {
    echo "ok";
    exit;
}

// 3) Pending (status 0), credit (status 1), or chargeback (status 2).
if ($status == 0) {
    savePendingTransaction($subId, $transId, $reward);
} elseif ($status == 1) {
    addPoints($subId, $reward);
} elseif ($status == 2) {
    subtractPoints($subId, $reward);
}

// 4) Optionally log the rest of the fields for analytics / fraud detection.
logConversion([
    'subId'        => $subId,
    'transId'      => $transId,
    'reward_pb'    => $reward,
    'reward_name'  => $rewardName,
    'payout_pb'    => $payout,
    'status'       => $status,
    'clicked_at'   => $clickedAt,
    'completed_at' => $completedAt,
    'ip'           => $ip,
    'country'      => $country,
]);

// 5) You MUST respond with exactly "ok", or we retry.
echo "ok";
Do this

Best Practices

Deduplicate transactions

Store every processed transId and ignore repeats. Never credit the same transaction twice.

Verify every signature

Reject postbacks with an invalid MD5 signature. Never expose the Forward Secret in client-side HTML.

Return "ok"

Respond with exactly ok and HTTP 2xx. Any other response is treated as a failure and retried.

Handle pending status

Store status 0 as pending. Credit only on status 1 and subtract only on status 2.

Respond quickly

Respond within 60 seconds. For slow work, acknowledge with ok and process it in the background.

Log every postback

Store timestamps, IP, country, and all other fields for fraud analysis and reconciliation.

Β© 2026 PubCrypto. Back to Home