Survey API security

Authenticate from your server

Call POST /getallsurveys-api over HTTPS from your backend. Send the publisher app key in the X-RapidoReach-Api-Key header. Do not expose this key in a browser, mobile application, URL, screenshot, or log. See the endpoint reference for the request body.

Preserve survey entry links

The API returns a SurveyUrl for each survey. Pass that URL to the respondent unchanged. The current URL includes internal routing and verification values, including i and enc; publishers do not need to calculate or append a separate hash parameter. Do not construct a URL from Link or send users directly to an upstream supplier.

See survey entry links for the supported flow. If you need an extra tracking parameter, arrange it with RapidoReach support rather than modifying a returned URL yourself.

Verify rewards on your server

The legacy publisher callback includes txnHash = md5(transactionId + AppSecret) and offerHash = md5(transactionId + AppKey). These hashes identify the transaction but do not sign every callback field, such as the reward amount. Receive callbacks over HTTPS, check the configured hash values and expected user, restrict callers using the current dashboard IP list where possible, and process each transaction idempotently. Treat browser redirects and SDK events as UI signals only.

Offers V2 has a separate signed callback flow; follow the configuration for the placement and slot you actually use.