Publisher API documentation

Redirect users to this link when they want to earn from your site.

https://offerwall.moneyrain.top/wall.php?pub=PUBLISHER_ID&uid=YOUR_USER_ID

For multiple publisher sites, add a site key. The site key is just a name and does not need to be a URL.

https://offerwall.moneyrain.top/wall.php?pub=PUBLISHER_ID&site=example.com&uid=YOUR_USER_ID

Use this when you want a small embedded widget with buttons for autosurf, PTC, and YouTube ads.

<iframe
  src="https://offerwall.moneyrain.top/embed.php?pub=PUBLISHER_ID&uid=YOUR_USER_ID"
  width="360"
  height="360"
  style="border:0;border-radius:8px;overflow:hidden"
  loading="lazy"></iframe>

For a named site callback, add &site=example.com to the iframe URL.

MoneyRain sends one callback after a publisher-link ad completion is credited. Configure the default callback for links without site, or add extra publisher sites for links with site=SITE_KEY.

Your endpoint receives a JSON POST. Read the raw body before decoding it because the signature is calculated from the exact raw body.

POST https://your-site.example/moneyrain-callback
Content-Type: application/json
User-Agent: MoneyRain-Offerwall/1.0.0
X-MoneyRain-Event: reward.completed
X-MoneyRain-Timestamp: 1782730000
X-MoneyRain-Signature: sha256=HEX_HMAC_SHA256

{
  "event": "reward.completed",
  "publisher_id": 123,
  "site": "example.com",
  "external_uid": "your-user-42",
  "view_id": 98765,
  "campaign_id": 555,
  "ad_type": "ptc",
  "reward_usdt": "0.00003000",
  "reward_currency_amount": "0.00150000",
  "reward_currency_name": "Penny coins",
  "reward_currency_per_usdt": "50.00000000",
  "advertiser_cost_usdt": "0.00005000",
  "status": "completed",
  "timestamp": 1782730000,
  "nonce": "random24hex"
}

The optional Hourly reward button uses the same callback URL, site secret, raw-body HMAC signature and currency conversion as ads. New rewards send reward.completed in both the JSON event and X-MoneyRain-Event header, immediately after verified completion. No cron job is required.

Deduplicate the positive numeric view_id exactly as for PTC. Hourly and ad rewards share one ID sequence, so their IDs cannot collide. ad_type is hourly, campaign_id is 0, and advertiser cost is zero. Allow these values if your receiver filters formats or campaign IDs. Hourly rewards do not increment ad-view counts.

{
  "event": "reward.completed",
  "reward_id": "hourly:123",
  "view_id": 98765,
  "campaign_id": 0,
  "publisher_id": 123,
  "site": "example.com",
  "external_uid": "your-user-42",
  "ad_type": "hourly",
  "reward_usdt": "0.00007000",
  "reward_currency_amount": "0.00350000",
  "reward_currency_name": "Penny coins",
  "reward_currency_per_usdt": "50.00000000",
  "advertiser_cost_usdt": "0.00000000",
  "status": "completed",
  "timestamp": 1789380000,
  "nonce": "random32hex"
}

Verify the signature before atomically storing the view ID and crediting the user. Return HTTP 200, 201, 202 or 204 only after accepting the reward; acknowledge duplicate IDs without crediting again. A failed delivery can be retried from the verified return page after two minutes. The ID, amount and currency stay fixed; each attempt has a fresh signed timestamp. Pending deliveries are retained until accepted.

Previously attempted v25 callbacks keep their original hourly_reward.completed event and string reward_id. Receivers that need these older rewards must also support and deduplicate that format; do not convert an attempted reward into a new ID, because a lost acknowledgement may hide an earlier credit.

The reward is based on the site's configured gross captcha CPM: CPM / 1,000, then 70% to the publisher. A qualifying publisher referrer receives another 5% of gross, not deducted from the publisher reward. No advertiser is charged. Cooldowns last one hour after completion, span a visitor's sites under the same publisher, and also apply per IP across the offerwall.

The widget shows a live countdown during this cooldown. Starting a new hourly captcha replaces unfinished captchas in the same visitor/IP scope; older returns show a closed, unrewarded result. A completed reward's cooldown cannot be replaced or reset. Countdown checks only read local reward state and never contact the captcha or IP-check providers.

Compare signatures with hash_equals. Only credit after the signature is valid and the view_id has not been credited before.

<?php
$secret = 'your callback secret';
$body = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_MONEYRAIN_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $body, $secret);

if (!hash_equals($expected, $header)) {
    http_response_code(403);
    exit('bad signature');
}

$payload = json_decode($body, true);
if (!is_array($payload) || ($payload['event'] ?? '') !== 'reward.completed') {
    http_response_code(400);
    exit('bad payload');
}

// 1. Check that view_id was not credited before.
// 2. Store view_id or nonce in your database.
// 3. Credit external_uid with reward_currency_amount.

http_response_code(200);
echo 'OK';

V1 stores the last callback status and failure count, but does not queue automatic retries. Respond with success only after you have safely recorded the reward.