Postbacks, Models API and secret-key security

Postbacks report eligible events

A postback can notify your server when a supported affiliate event is recorded. Validate event identifiers, protect the receiver, make processing idempotent and never trigger fake conversions during testing.

Models API supports directories

The API can provide current public model inventory for approved domains. Cache responsibly, respect limits, remove stale availability and link to the exact model room through approved tracking.

Keys stay on the server

Secret tokens, statistics keys and private API credentials must never appear in browser JavaScript, screenshots, public repositories, sitemap URLs or analytics parameters.

• Store secrets in production environment variables
• Rotate a key after suspected exposure
• Restrict CORS and request methods
• Rate-limit sync and postback endpoints
• Log identifiers, never full secrets