Integration guide

Signature verification

HMAC-SHA256 signature used to prove postbacks came from PrismAds.

Signature verification

signature = HMAC-SHA256 hex of this message, keyed with your signing secret:

code

{user_id}.{trunc(value)}.{token}

token is the same as txid
value is truncated to an integer (e.g. 100.7 → 100)
Compare with a constant-time equals (hash_equals, crypto.timingSafeEqual)

Which secret?

Callback	Secret to use
Live conversion (Reports → Postbacks)	Signing secret shown when you create that postback
`/api/v1/postback/test`	Placement secret key (`sk_`)

Node.js

import crypto from 'crypto';

function expected(secret, userId, value, token) {
  const message = `${userId}.${Math.trunc(Number(value))}.${token}`;
  return crypto.createHmac('sha256', secret).update(message).digest('hex');
}

Python

python

import hashlib
import hmac
message = f"{user_id}.{int(float(value))}.{token}"
hmac.new(secret.encode(), message.encode(), hashlib.sha256).hexdigest()

Only you and PrismAds know the secret, so third parties cannot forge valid callbacks.

S2S postback

Test postback