Skip to main content
Version: v2

Configure offer S2S tracking

Self-service direct offers in Campaign Studio use Custom S2S (HMAC) when that certified tracking choice is enabled for the account. The selected partner and callback endpoint shown in the campaign's tracking setup are authoritative. Older DIRECT campaigns can use an advertiser token endpoint; do not interchange those credentials or URLs.

Preserve the click ID​

  1. Include {click_id} in the campaign's HTTPS destination or tracking link.
  2. When RapidoReach launches the offer, store the resolved click ID with your user event or order on your server.
  3. After you verify the conversion, send click_id, your stable transaction_id, the exact milestone goal_id, status, and occurred_at to the endpoint shown in tracking setup.
  4. Check the response and retry a timeout with the same transaction ID and state. Never generate a new ID for the same conversion.

A click, install, pixel, or client-side success message is not proof of a verified reward. A web pixel, when enabled, is telemetry; advertiser S2S verification still controls the reward.

Custom S2S HMAC callback​

Campaign Studio creates a campaign-specific credential. Copy the one-time secret into protected server configuration and retain the returned key ID. Send a JSON POST to:

/performance-marketing/v2/postbacks/custom-s2s/{campaignId}

The required headers are X-RapidoReach-Key-Id, X-RapidoReach-Timestamp (Unix seconds), and X-RapidoReach-Signature. Sign the UTF-8 text below with HMAC-SHA256 and encode the digest as lowercase hex:

{timestamp}\n{click_id}\n{transaction_id}\n{goal_id}\n{status}\n{occurred_at}

Use the exact strings sent in the JSON body. The timestamp must be within five minutes of the server clock. The callback IP must match the campaign allowlist when one is configured. A valid event uses pending, approved, rejected, or reversed and an ISO 8601 occurred_at value. The advertiser offer API reference has a complete request and signing example.

The Test custom S2S action verifies a stored credential in memory and reports deliveredExternally: false and accountingWrites: 0. It proves the configured secret can sign and verify a sample; it does not prove that your external endpoint or a real click works. Complete a separate development click and callback test before launch.

Pending, approved, and reversed events​

A pending event can later become approved or rejected. An approved event may be reversed after a refund or invalid traffic decision. Keep the same transaction and goal association across state changes. RapidoReach stores callbacks durably, deduplicates retries, and records ledger adjustments rather than rewriting historical conversions. Your reporting should distinguish accepted callbacks, verified conversions, pending rewards, and reversals.

Key rotation​

Stage a new secret with an activation time at least five minutes and at most seven days ahead. The old key overlaps for 24 hours after activation. Deploy the new key to your sender before the activation time, send test traffic, and keep the old key available during overlap. Do not log either secret.

For managed MMP campaigns, use the provider-specific callback URL and token shown in tracking setup; RapidoReach support verifies the integration before approval. For a legacy DIRECT campaign, use its /postbacks/direct advertiser token flow only when that is what tracking setup returns.

Next: Submit and operate the campaign.