Fetch offers, send events, verify every postback.

curl -G "https://affiliateos.xyz/publisher/offers" \
  -d country=US -d platform=iOS -d page=1 \
  --data-urlencode "name=harbor blocks" \
  -H "x-api-key: $AFFILIATEOS_KEY"

const url = new URL(
  "https://affiliateos.xyz/publisher/offers",
);
url.search = new URLSearchParams({
  country: "US",
  platform: "iOS",
  page: "1",
  name: "harbor blocks",
});

const res = await fetch(url, {
  headers: { "x-api-key": process.env.AFFILIATEOS_KEY },
});
const { data } = await res.json();
console.log(data.offers.length, data.pagination.total);

import os, requests

r = requests.get(
    "https://affiliateos.xyz/publisher/offers",
    params={"country": "US", "platform": "iOS",
            "page": 1, "name": "harbor blocks"},
    headers={"x-api-key": os.environ["AFFILIATEOS_KEY"]},
)
offers = r.json()["data"]["offers"]

{
  "status": "success",
  "data": {
    "offers": [
      {
        "id": "aff_7c2e91b04d3a",
        "name": "Harbor Blocks",
        "trackingType": "CPI",
        "platforms": ["ios"],
        "isPaidOnInstall": true,
        "effectivePayoutUsd": 4.2,
        "trackingUrl":
          "https://click.affiliateos.ai/click?off_id=…",
        "goals": [
          {
            "id": "1",
            "name": "Install",
            "effectivePayoutUsd": 4.2,
            "userRewardUsd": 1.5,
            "userRewardIsAdvertiserSet": true
          },
          {
            "id": "6",
            "name": "Reach level 10",
            "effectivePayoutUsd": 0,
            "userRewardUsd": 1.5,
            "userRewardIsAdvertiserSet": true
          }
        ]
      }
    ],
    "pagination": {
      "current_page": 1,
      "per_page": 50,
      "total": 1,
      "has_more_pages": false
    }
  }
}

curl -G "https://affiliateos.xyz/publisher/offers" \
  -d segment=top -d country=US \
  -H "x-api-key: $AFFILIATEOS_KEY"

const url = new URL(
  "https://affiliateos.xyz/publisher/offers",
);
url.search = new URLSearchParams({
  segment: "top",
  country: "US",
});

const res = await fetch(url, {
  headers: { "x-api-key": process.env.AFFILIATEOS_KEY },
});
// Rows arrive in our order: keep it.
const { data } = await res.json();

<iframe
  src="https://offerwall.affiliateos.xyz/w/owapp_your_app
?uid=u_48213&source=iframe&country=US"
  style="width:100%;height:720px;border:0"
  allow="clipboard-write"
></iframe>

const crypto = require("crypto");

// Runs on your server. The ows_ secret stays there.
function wallUrl(uid, country) {
  const appId = process.env.OFFERWALL_APP_ID; // owapp_
  const secret = process.env.OFFERWALL_APP_SECRET; // ows_
  const ts = Math.floor(Date.now() / 1000);
  const rand = crypto.randomBytes(12).toString("hex");
  const nonce = "nonce_" + rand;
  const sig = crypto
    .createHmac("sha256", secret)
    .update([appId, uid, ts, nonce].join("\n"))
    .digest("hex");
  const base = "https://offerwall.affiliateos.xyz/w/";
  const url = new URL(base + appId);
  const params = { uid, ts, nonce, sig, country };
  for (const [k, v] of Object.entries(params)) {
    url.searchParams.set(k, String(v));
  }
  return url.toString();
}

GET https://api.pebble.example/afos
  ?action_id=act_5Kq2Wc
  &sub_id=u_48213
  &offer_id=aff_7c2e91b04d3a
  &status=completed
  &payout=4.20
  &user_payout=1.50
  &conversion_name=Install
  &offer_name=Harbor+Blocks
  &goal_id=1
  &is_offer_complete=false
  &clicktimestamp=2026-10-29T19:06:00Z
  &verifier=9f86d081884c7d659a2feaa0c55ad015…

const crypto = require("crypto");

// Verify each postback before you credit anything.
app.get("/afos", (req, res) => {
  const host = `${req.protocol}://${req.get("host")}`;
  const url = new URL(host + req.originalUrl);
  const verifier = url.searchParams.get("verifier");
  url.searchParams.delete("verifier");
  const secret = process.env.AFOS_POSTBACK_SECRET; // ps_
  const expected = crypto
    .createHmac("sha256", secret)
    .update(url.toString())
    .digest("hex");
  if (expected !== verifier) {
    return res.status(401).send("Invalid verifier");
  }
  // Credit on completed, deduct on reversed.
  // Dedupe on action_id and status together.
  res.sendStatus(200);
});

import hmac, hashlib, os

def is_from_affiliateos(full_url: str) -> bool:
    # Strip verifier from the URL exactly as received.
    # Never re-encode the rest.
    base, _, query = full_url.partition("?")
    kept, received = [], ""
    for pair in query.split("&"):
        if pair.startswith("verifier="):
            received = pair[len("verifier="):]
        else:
            kept.append(pair)
    rest = "&".join(kept)
    unsigned = f"{base}?{rest}" if rest else base
    secret = os.environ["AFOS_POSTBACK_SECRET"].encode()
    expected = hmac.new(
        secret, unsigned.encode(), hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, received)

curl -X POST \
  "https://affiliateos.xyz/v1/advertiser/events" \
  -H "Authorization: Bearer $AFOS_ADVERTISER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "clickId": "clk_7Q2f81",
    "advertiserUserId": "tp_player_7731",
    "eventKey": "level_25",
    "eventId": "level_25_tp_player_7731",
    "timestamp": "2026-10-29T19:31:00.000Z",
    "appId": "your_app_id",
    "test": true
  }'

const API = "https://affiliateos.xyz";
const key = process.env.AFOS_ADVERTISER_KEY;

await fetch(`${API}/v1/advertiser/events`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${key}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    // stored from afos_click_id when the player arrived
    clickId: user.afosClickId,
    advertiserUserId: user.id,
    eventKey: "level_25",
    // stable, so a retry comes back as duplicate
    eventId: `level_25_${user.id}`,
    timestamp: new Date().toISOString(),
    appId: process.env.AFOS_APP_ID,
    test: false,
  }),
});

{
  "status": "approved",
  "logId": "evl_3Hc9Qm",
  "payoutUsd": 1.5
}

curl -G "https://affiliateos.xyz/network-api/offers" \
  -d country=US -d platform=iOS -d page=1 -d per_page=50 \
  -H "x-api-key: $NORTHFOLD_NETWORK_KEY"

const base = "https://affiliateos.xyz/network-api/offers";
const key = process.env.NORTHFOLD_NETWORK_KEY;
const all = [];
let page = 1;
for (;;) {
  const qs = `?country=US&page=${page}&per_page=100`;
  const res = await fetch(base + qs, {
    headers: { "x-api-key": key },
  });
  const { data } = await res.json();
  all.push(...data.offers);
  if (!data.pagination.has_more_pages) break;
  page += 1;
}