Server-to-server reward callbacks

RapidoReach sends a GET request to the callback URL configured for your publisher app when a transaction changes state. Configure an HTTPS endpoint in the dashboard's Apps → Callback section. Use the dashboard's Test Callback action before going live.

Process a callback

1. Parse transactionId, endUserId, status, currencyAmt, offerHash, and txnHash from the query string.
2. Recompute offerHash as lowercase MD5 of transactionId + AppKey and txnHash as lowercase MD5 of transactionId + AppSecret using the credentials for this app. Compare hashes in constant time.
3. Confirm the user and transaction are valid for your app. Process each transactionId and status transition once, including repeated deliveries. Apply your reward and reversal policy for C, F, P, and R.
4. Respond with HTTP 200 only after successful processing. The current delivery code checks the HTTP status, not a response body of 1 or 0; return a non-200 status when processing fails so delivery is recorded as failed.

The legacy hashes cover the transaction ID, not every query field. Do not treat them as a signature over currencyAmt or other callback values. Use HTTPS, check the current callback source IP list from the dashboard where feasible, and keep the App Key and App Secret on your server. Do not award from an SDK reward event or redirect alone.

Fields

Parameter	Meaning
transactionId	Transaction identifier used for deduplication and support.
offerInvitationId	Usually the same transaction identifier in the current callback implementation.
endUserId	Your app user ID used in the integration.
userId	RapidoReach UID.
status / cmd	Transaction state: complete (C), screenout (F), overquota (P), or reversal (R) where applicable.
currencyAmt	Configured virtual currency amount. Reversals can be negative.
amt	Publisher amount in dollars.
offerHash	MD5 of transactionId + AppKey.
txnHash	MD5 of transactionId + AppSecret (also called Transaction Key).
currencyName, offerType, deviceType	Context for reporting.
intergrationMethod	Integration method. The misspelling is part of the current callback parameter name.

Test before launch

In the dashboard, save your callback URL, copy the current source IP list if you enforce an allowlist, and send a test callback. Check that your endpoint accepts the first delivery, rejects a wrong hash, and does not credit a duplicate. Test a reversal against an already credited transaction. See the integration testing checklist.

For Offers V2 slots, follow the placement-specific callback setup instead of assuming this legacy hash contract applies.