Open the wall: simple links and signed links

Look at Docs, then Hosted Offerwall (or the property’s Integrations tab if your account uses Properties & Apps):

• A copyable snippet means your wall opens with simple links.
• A note that the wall requires server-signed launch URLs means every launch must be signed.

New walls start on simple links. Walls created before the choice existed require signed links, so a live integration was never loosened without its owner asking.

https://offerwall.affiliateos.xyz/w/owapp_your_wall?uid=u_48213&source=hosted&country=US

Example: user u_48213 in the US, opened as a page of its own.

Why a simple link is safe. Every postback is signed with your postback secret, however the wall was opened. Someone who edits the uid in a simple link can open the wall as another of your user IDs, and anything they complete there credits that ID. There’s nothing to take.

1. 01

   Keep the wall secret on your server

   Signing needs the wall’s secret, which starts with ows_. It’s shown once, when you create a wall for a new property in Properties & Apps (Copy the offerwall secret now). The wall that came with your account doesn’t show its secret: email us if you need signed links on it. Never put the secret in an app or a web page.

2. 02

   Build the URL on your server

   Sign four values in this order, joined by a newline: the wall ID, the uid, the time in Unix seconds (ts) and a value used once (nonce). If the URL carries a property_id, sign it too, as a fifth line.

   JavaScriptCopy

   const crypto = require("crypto");
   
   function wallUrl(uid, propertyId) {
     const appId = process.env.OFFERWALL_APP_ID; // owapp_...
     const secret = process.env.OFFERWALL_APP_SECRET; // ows_...
     const ts = Math.floor(Date.now() / 1000); // seconds
     const nonce = "nonce_" + crypto.randomBytes(12).toString("hex");
     const fields = [appId, uid, ts, nonce];
     if (propertyId) fields.push(propertyId);
     const sig = crypto
       .createHmac("sha256", secret)
       .update(fields.join("\n"))
       .digest("hex");
   
     const url = new URL("https://offerwall.affiliateos.xyz/w/" + appId);
     url.searchParams.set("uid", uid);
     url.searchParams.set("ts", String(ts));
     url.searchParams.set("nonce", nonce);
     url.searchParams.set("sig", sig);
     url.searchParams.set("source", "hosted");
     url.searchParams.set("country", "US");
     if (propertyId) url.searchParams.set("property_id", propertyId);
     return url.toString();
   }

3. 03

   Hand your app the finished URL

   Your page or app asks your server for a new URL each time it opens the wall, and uses it straight away.

4. 04

   Check it worked

   Open a fresh URL: the wall loads. Reload the same tab: you get “This offerwall link is invalid or expired.” That’s the single-use rule working. If the first open fails, go through the invalid or expired checks.

A wall on simple links still checks any signature a launch carries, so you can build and test signing without changing anything. A link that carries any of ts, nonce or sig is checked as a signed launch, so don’t leave half a signature in a simple link.

Making signatures required, so unsigned links stop working, is a setting on the wall that the dashboard doesn’t show. To change it in either direction, email hello@affiliateos.ai with your wall ID (owapp_...). Switch your links over first: the moment a wall requires signatures, every unsigned link stops opening it.