> AffiliateOS Help Center. Index of every article for AI tools: https://www.affiliateos.ai/help/llms.txt

# Open the wall: simple links and signed links

Hosted Offerwall · For publishers · Updated 30 October 2026
Web version: https://www.affiliateos.ai/help/offerwall/simple-and-signed-links

A simple link opens your wall with nothing but your user's ID in it, and every new wall uses simple links. A signed link adds a signature made on your server and works once, within 5 minutes. Start with simple: your conversions are signed either way.

## Which kind your wall takes

Look at **Docs**, then **Hosted Offerwall** (or the property's **Integrations** tab if your account uses **Properties & Apps**):

- A copyable snippet means your wall opens with simple links.
- A note that the wall requires server-signed launch URLs means every launch must be signed.

New walls start on simple links. Walls created before the choice existed require signed links, so a live integration was never loosened without its owner asking.

## A simple link

```text
https://offerwall.affiliateos.xyz/w/owapp_your_wall?uid=u_48213&source=hosted&country=US
```

Example: user u_48213 in the US, opened as a page of its own.

| Parameter | Needed | What it does |
|---|---|---|
| `uid` | Yes | Your user's ID. It comes back as `sub_id` on every postback for this user. |
| `country` | Send it | Two-letter country code. Without it the wall lists offers from every country, and installs on the wrong ones never convert. |
| `source` | No | Where the wall is shown: `hosted`, `iframe`, `ios` or `android`. Any other value, or the parameter twice, and the launch is refused. |
| `platform` | No | `ios` or `android` when your app knows the phone. Without it the wall reads the browser. |
| `device_id` | No | The phone's advertising ID (IDFA or GAID) when you have it. It rides on every offer the user starts and helps advertisers confirm installs. |
| `property_id` | No | Your property's ID, when your account uses **Properties & Apps**. The property's own snippet already has it. |

**Why a simple link is safe.** Every [postback](https://www.affiliateos.ai/glossary#postback) is signed with your postback secret, however the wall was opened. Someone who edits the `uid` in a simple link can open the wall as another of your user IDs, and anything they complete there credits that ID. There's nothing to take.

## Sign a launch

### Keep the wall secret on your server

Signing needs the wall's secret, which starts with `ows_`. It's shown once, when you create a wall for a new property in **Properties & Apps** (**Copy the offerwall secret now**). The wall that came with your account doesn't show its secret: email us if you need signed links on it. Never put the secret in an app or a web page.

### Build the URL on your server

Sign four values in this order, joined by a newline: the wall ID, the `uid`, the time in Unix seconds (`ts`) and a value used once (`nonce`). If the URL carries a `property_id`, sign it too, as a fifth line.

```js
const crypto = require("crypto");

function wallUrl(uid, propertyId) {
  const appId = process.env.OFFERWALL_APP_ID; // owapp_...
  const secret = process.env.OFFERWALL_APP_SECRET; // ows_...
  const ts = Math.floor(Date.now() / 1000); // seconds
  const nonce = "nonce_" + crypto.randomBytes(12).toString("hex");
  const fields = [appId, uid, ts, nonce];
  if (propertyId) fields.push(propertyId);
  const sig = crypto
    .createHmac("sha256", secret)
    .update(fields.join("\n"))
    .digest("hex");

  const url = new URL("https://offerwall.affiliateos.xyz/w/" + appId);
  url.searchParams.set("uid", uid);
  url.searchParams.set("ts", String(ts));
  url.searchParams.set("nonce", nonce);
  url.searchParams.set("sig", sig);
  url.searchParams.set("source", "hosted");
  url.searchParams.set("country", "US");
  if (propertyId) url.searchParams.set("property_id", propertyId);
  return url.toString();
}
```

### Hand your app the finished URL

Your page or app asks your server for a new URL each time it opens the wall, and uses it straight away.

> **A signed link works once, within 5 minutes.** The first open uses up its `nonce`. A reload, or the same link opened again, shows "This offerwall link is invalid or expired." A `ts` more than 5 minutes away from our clock, either way, fails too: check your server's clock, and send seconds, not milliseconds.

### Check it worked

Open a fresh URL: the wall loads. Reload the same tab: you get "This offerwall link is invalid or expired." That's the single-use rule working. If the first open fails, go through [the invalid or expired checks](https://www.affiliateos.ai/help/offerwall/link-invalid-or-expired).

## Require a signature on every launch

A wall on simple links still checks any signature a launch carries, so you can build and test signing without changing anything. A link that carries any of `ts`, `nonce` or `sig` is checked as a signed launch, so don't leave half a signature in a simple link.

Making signatures required, so unsigned links stop working, is a setting on the wall that the dashboard doesn't show. To change it in either direction, email [hello@affiliateos.ai](mailto:hello@affiliateos.ai) with your wall ID (`owapp_...`). Switch your links over first: the moment a wall requires signatures, every unsigned link stops opening it.