Server-to-server callback

AppLovin’s servers can make server-to-server rewarded callbacks to an external server endpoint that you define. These callbacks notify you that a user of your app completed a rewarded ad and qualifies for a reward. This protects against malicious users who attempt to gain rewards without finishing rewarded ads.

Note that these server-to-server callbacks are not sent for test ads, only live ads.

For details, see the MAX S2S rewarded callback API documentation.

You configure these callbacks by setting the value of Server Side Callback URL. For MAX-mediated rewarded ad units, you can do this in the Ad Unit edit page. If you do not use MAX, do this in the Manage Apps section.

AppLovin’s server-to-server callback has a slightly different implementation from some other providers you may be familiar with. Here are the important differences:

• The AppLovin server-to-server callback never transmits through the user’s device. After the SDK verifies that the rewarded video was fully watched, and after all other client-side processes complete, the SDK notifies AppLovin’s server. AppLovin’s server then makes a request to the endpoint you specify. Because the AppLovin server (not the user device) makes the request, the user cannot hack the callback to fraudulently reward themselves.

• You can specify which variables you would like to receive in the server-to-server callback. These variables include currency type/amount, user device IDs, etc. See “Available macros” for a complete list.

• You can verify that these requests come from AppLovin by taking advantage of your Event Key. You can include {EVENT_ID} (a unique transaction ID) and {EVENT_TOKEN} as values in your callback. AppLovin replaces the {EVENT_TOKEN} macro with a value that it generates via an SHA1 hash of the Event ID and Event Key: sha1( «Event-ID» + «Event-Key» )

  For example, if your event key is "uHXOnmfO2f3wd-syBwXxsj7m53qiJoI9VzXTvE8LOSnIWjS6zzxS8HgSIBJSbQWdS1czmgwXSWDaKwehtjyYl_" and the Event ID is "14a97273742c0c9e8864fe40193dad5506e930bc", the {EVENT_TOKEN} macro will populate with 3724081c17d32a66276ffff2a14b124a278934e9, which AppLovin calculates with sha1(14a97273742c0c9e8864fe40193dad5506e930bcuHXOnmfO2f3wd-syBwXxsj7m53qiJoI9VzXTvE8LOSnIWjS6zzxS8HgSIBJSbQWdS1czmgwXSWDaKwehtjyYl_)

  You can find your Event Key in the Account > General > Keys section of the AppLovin dashboard.