The same wall, wrapped for a phone.

Two values configure it, the same two the URL needs: the placement id and a signed wall URL your server builds for the user. The signature below is the shape we are designing against, and we will publish the released one before anyone has to write against it.

// Configure once, at start-up.
OpusWall.configure(
  placementId: "fbefb48b-df2e-4102-9e05-f48c4083edc2"
)

// Present the wall for the signed-in user, with the URL your server signed.
OpusWall.presentWall(
  signedWallUrl: urlFromYourServer,
  onClose: { /* refresh the user's balance */ }
)

An app may want to tell a user that something was completed. That notice is a convenience and nothing more. The money is decided by the server postback described below, which your backend receives directly from us and can verify.

Never credit a user from a client-side signal alone. A phone is not a trustworthy source of truth about money, and treating it as one is how reward systems get drained.

The SDK is designed to take an opaque user id from you and nothing else. It does not ask for contacts, location or an advertising identifier, and it is not an analytics package wearing a different hat.

When a conversion from your wall settles — the advertiser confirmed it and the money moved — we call the postback URL on your placement, https only. When a settled conversion is reversed, we call it again so you can take the reward back. GET appends the parameters to your URL's query; POST sends them as a form body. Your placement's page shows every attempt with your server's answer, and sends test postbacks.

All fifteen parameters are always present, empty when there is nothing to send, followed by signature: the HMAC of the fifteen, in the order above, with your placement's postback secret. Verify it, and refuse a timestamp more than an hour old — we sign every attempt as it leaves.

• Acknowledge with any 2xx status and a body of exactly OK or 1. Anything else — another body, a redirect, an error, no answer within 10 seconds — is a failed attempt.
• A failed attempt is retried after 1 minute, 5 and 15 minutes, 1, 3, 6 and 12 hours, then 24 hours twice: ten attempts over about three days. An abandoned notice can be re-queued from your panel for 30 days.
• Credit once per (transaction_id, status), under a unique constraint in the same transaction as the credit. On a reversal, take back only what you credited; if you never did, answer OK and do nothing.
• We never send a credit after its reversal, or a reversal for a credit that never left us.
• We call only public addresses: your hostname is resolved once per attempt and refused if any address it resolves to is private, loopback, link-local or reserved. We connect to the address we checked, follow no redirect and read at most 16 KiB.

GET https://example.com/opuswall/postback?site=main
  &amount=1750
  &campaign_id=4a3a4905-900d-4fb1-b719-432d3e292085
  &campaign_name=Example%20campaign
  &goal_id=0f5b8d2e-6c1a-4e9b-b3d7-5a2c8e4f1b90
  &goal_name=Example%20goal
  &placement_id=fbefb48b-df2e-4102-9e05-f48c4083edc2
  &share_usd_cents=175
  &status=credit
  &sub_id1=summer-2026&sub_id2=&sub_id3=
  &test=0
  &timestamp=1790000000
  &transaction_id=c8e1b0d4-7a2f-4c6e-9b3d-1e5f7a9c2b4d
  &user_id=player%2048213
  &signature=60996fe5750f91e727d8d1acbb1afc765f4284d6fecf377f941e900d8eab91ab

Secret e1d2c3b4a5968778695a4b3c2d1e0f1a2b3c4d5e6f708192a3b4c5d6e7f80912 (an example).
Broken over lines for reading; sent as one. Your own site=main is not signed.

Open the signed wall URL in a webview, and open offers outside it. When the SDK arrives it will do exactly this, with the presentation details handled for you, and your placement, your postback and your user ids will not change.