Tracking andpostbacks

How it works

1. A player clicks your casino on Prizestack. We record the click and send them to your landing URL with our click id added.
2. They register. Your tracking stores our click id on the player, the same way it stores any affiliate sub-id.
3. They deposit and play. Your server sends us a postback for each event, carrying the click id.
4. We credit tickets. The player earns tickets in the Prizestack daily draw at the rate on your listing. We hold them for your reversal window, then enter them. Players see them on their account the moment your postback lands.

You pay us through your normal affiliate terms. The tickets and the prizes cost you nothing.

What we need from you

1. Your affiliate tag or account for Prizestack.
2. The landing URL players should arrive on.
3. The sub-id parameter that carries our click id through registration (clickid, subid, var1 or similar).
4. Server-to-server postbacks for reg, ftd, deposit, wager and reversal: paste the five URLs we send you into your affiliate platform and map each placeholder to your macro.
5. Your reversal window in days, if it is not 7.
6. A test account, so we can run one click, one registration and one deposit together before launch.

We send you back your source name and five ready postback URLs carrying your own token, by a private channel. If your server signs requests, ask for a signing secret instead.

The tracked link

Every link to you from Prizestack passes through our redirect, then lands on your URL with our click id in the parameter you name. Ids are random and single use, so a click id always means one visit by one person.

https://your-casino.com/?aff=PRIZESTACK&clickid=8f2c41d0-6b1e-4f7a-9d3e-2a5c7b90e114
                                       └ your affiliate tag   └ our click id, unique per click

Keep the click id through registration, including when the player lands on a game or promotion page instead of your home page. Players who were signed out when they clicked still count: they claim the click when they sign in to Prizestack within 30 days.

The postback

One endpoint, called from your server when something happens to a player we sent you. GET with a query string, POST with a form body, or POST with JSON all work.

GET https://prizestack.cx/api/postback/your-casino
    ?event=ftd
    &clickid=8f2c41d0-6b1e-4f7a-9d3e-2a5c7b90e114
    &player=p_7731
    &amount=150.00
    &txid=dep_558190
    &token=YOUR_TOKEN

A source can only report on players we sent to that casino. Postbacks that name another operator's click are stored and earn nothing.

Postback URLs

Most affiliate platforms fire one URL template per event. These are the five templates; we send you yours with your source name and token filled in. Replace each placeholder in capitals with your platform's own macro (for example {SUB_ID} becomes the macro that holds our click id).

If your platform has no transaction id for registrations, the player id with a suffix (as above) is fine: txid only has to be unique per event.

Events

Tickets follow the rule on your listing, for example 20 on a first deposit and 1 per $25 deposited or wagered, with a daily cap per player. Every event is stored, including ones that earn no tickets, so our reports match yours.

Authentication

Each operator authenticates its own postbacks. Use one of three ways:

1. Token (option A, most platforms). A secret token of yours, fixed in every postback URL as token=. Keep the URLs private; we rotate the token on request.
2. Signature (option B). If your server builds its own requests, sign each one with HMAC-SHA256 over the canonical string below, using a secret we send you.
3. IP allowlist (option C). Fixed IPs your postbacks come from, allowed for your source only.

canonical = every parameter except sig, sorted by key, joined as key=value with &,
            values raw (not URL-encoded)

amount=150.00&clickid=8f2c41d0-6b1e-4f7a-9d3e-2a5c7b90e114&currency=USD&event=ftd&player=p_7731&txid=dep_558190

sig = hex( HMAC-SHA256( your_secret, canonical ) )

import { createHmac } from "node:crypto";

function sign(params, secret) {
  const canonical = Object.keys(params).filter((k) => k !== "sig").sort()
    .map((k) => `${k}=${params[k]}`).join("&");
  return createHmac("sha256", secret).update(canonical).digest("hex");
}

const params = { clickid, event: "ftd", amount: "150.00", currency: "USD", txid: "dep_558190", player: "p_7731" };
await fetch("https://prizestack.cx/api/postback/your-casino", {
  method: "POST",
  headers: { "content-type": "application/x-www-form-urlencoded", "x-signature": sign(params, SECRET) },
  body: new URLSearchParams(params),
});

Responses and retries

200 OK
{ "ok": true, "tickets": 40, "eventId": "4f0a…" }

200 OK  (same txid again)
{ "ok": true, "tickets": 40, "eventId": "4f0a…", "duplicate": true }

tickets is what the event earned after the daily cap. A reason field explains a zero: unknown_click for a click id we never issued, anonymous_click for a player not yet signed in to Prizestack (credited when they sign in), source_mismatch for another operator's click.

Retry timeouts and 5xx responses with the same txid. A repeat is answered with duplicate: true and changes nothing, so retries are always safe.

Testing

1. We send you a test click link. Open it, register a test account and check your tracking stored the click id.
2. Fire a reg postback for that player. We confirm we received it.
3. Make a small test deposit and fire ftd. The test player sees the tickets on their Prizestack account.
4. Fire a reversal with the deposit's txid. The tickets disappear.

curl "https://prizestack.cx/api/postback/your-casino?event=reg&clickid=<the id from your test click>&player=test_1&txid=test_reg_1&token=YOUR_TOKEN"

Reporting

We keep every click and every event you send, per day: clicks, registrations, first deposits, deposit and wager volume, and reversals. We reconcile them with your affiliate dashboard each month and send you the export on request. Player data stays pseudonymous on both sides.

Running your own prize draw for your players is a separate product: see the entries API.