Postback Security

This page will guide you through the integration security in your postback

To make postbacks safe, you should verify the signature received in the postback. This is an important feature for you to make sure that the postback, which you use as a base to reward your users, is coming from Revlum and is not fake. By checking the hash, you can be sure that the postback was sent by us and that it is legit.
The signature parameter should match the MD5 of the subId transactionId reward secretkey.

The formula to be checked is as follows:

<?php
   $secret = ""; // Get your secret key from Revlum
 
   $subId = isset($_REQUEST['subId']) ? $_REQUEST['subId'] : null;
   $transId = isset($_REQUEST['transId']) ? $_REQUEST['transId'] : null;
   $reward = isset($_REQUEST['reward']) ? $_REQUEST['reward'] : null;
   $signature = isset($_REQUEST['signature']) ? $_REQUEST['signature'] : null;
 
   // Validate Signature
   if(md5($subId.$transId.$reward.$secret) != $signature)
   {
    echo "ERROR: Signature doesn't match";
    return;
   }
 ?>
const express = require('express');
const crypto = require('crypto');

const app = express();
const secret = "";  // Get your secret key from Revlum

app.get('/your-endpoint', (req, res) => {
  const { subId, transId, reward, signature } = req.query;

  // Validate Signature
  const hash = crypto.createHash('md5').update(subId + transId + reward + secret).digest('hex');
  if (hash !== signature) {
    res.send("ERROR: Signature doesn't match");
    return;
  }
  res.send("Signature is valid");
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

@SpringBootApplication
@RestController
public class Application {

    private static final String secret = "";  // Get your secret key from Revlum

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }

    @GetMapping("/your-endpoint")
    public String validateSignature(@RequestParam String subId,
                                    @RequestParam String transId,
                                    @RequestParam String reward,
                                    @RequestParam String signature) throws NoSuchAlgorithmException {
        MessageDigest md = MessageDigest.getInstance("MD5");
        byte[] hashBytes = md.digest((subId + transId + reward + secret).getBytes());
        StringBuilder sb = new StringBuilder();
        for (byte b : hashBytes) {
            sb.append(String.format("%02x", b));
        }
        if (!sb.toString().equals(signature)) {
            return "ERROR: Signature doesn't match";
        }
        return "Signature is valid";
    }
}

const express = require('express');
const crypto = require('crypto');

const app = express();
const secret = "";  // Get your secret key from Revlum

app.get('/api/validate', (req, res) => {
  const { subId, transId, reward, signature } = req.query;

  // Validate Signature
  const hash = crypto.createHash('md5').update(subId + transId + reward + secret).digest('hex');
  if (hash !== signature) {
    res.send("ERROR: Signature doesn't match");
    return;
  }
  res.send("Signature is valid");
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

using System;
using System.Security.Cryptography;
using System.Text;

public class SignatureValidation
{
    private string secret = ""; // Get your secret key from Revlum

    public void ValidateSignature(string subId, string transId, string reward, string signature)
    {
        string dataToValidate = subId + transId + reward + secret;
        string calculatedSignature = CalculateMD5Hash(dataToValidate);

        if (calculatedSignature != signature)
        {
            Console.WriteLine("ERROR: Signature doesn't match");
            return;
        }

        // Continue processing as signature is valid
    }

    private string CalculateMD5Hash(string input)
    {
        using (MD5 md5 = MD5.Create())
        {
            byte[] inputBytes = Encoding.ASCII.GetBytes(input);
            byte[] hashBytes = md5.ComputeHash(inputBytes);

            StringBuilder sb = new StringBuilder();
            foreach (byte b in hashBytes)
            {
                sb.Append(b.ToString("X2"));
            }
            return sb.ToString().ToLower();
        }
    }
}

namespace App\Http\Controllers;

use Illuminate\Http\Request;

class SignatureValidationController extends Controller
{
    private $secret = ''; // Get your secret key from Revlum

    public function validateSignature(Request $request)
    {
        $subId = $request->input('subId');
        $transId = $request->input('transId');
        $reward = $request->input('reward');
        $signature = $request->input('signature');

        if (md5($subId . $transId . $reward . $this->secret) != $signature) {
            return response()->json(['error' => "Signature doesn't match"], 400);
        }

        // Continue processing as signature is valid
    }
}

Our servers wait for a response for a maximum time of 60 seconds before the timeout. In this case, postback will be marked as failed. Please, check if the transaction ID sent to you was already entered in your database, this will prevent giving twice the same amount of virtual currency to the user.

Whitelist our IP

We will be sending postbacks from any of the following IP addresses. Please make sure they are whitelisted if needed to be on your server.

πŸ‘

209.159.156.198

Our servers will expect your website to respond with "ok". If your postback doesn't return "ok" as a response, the postback will be marked as failed (even if the postback was successfully called) and you will be able to resend it manually from our website.