Calling shortener APIs, signed return tokens, completion verification and loop protection.
6 entries
Every provider shortens by API: you POST or GET their endpoint with your token and a destination, and they return JSON containing the short URL. Gluing a destination onto a base URL works with none of them.
Providers do not postback, so the round trip is the only evidence. Single use, account bound, expiring, minimum dwell, and starting a new run kills the old one.
Token, ownership, dwell and caps are the honest limit. None of them prove the provider's page was ever seen — the daily cap is what bounds the loss.
Spread traffic across providers so one outage or one bad rate does not take the whole earning page down, with a weight you can tune per provider.
The request URL contains your key. Flash it in an error and anyone who can make the provider fail can read it.
Ad networks and faucet scripts validate against the common shape, which is /api?api=TOKEN&url=. A rewrite gives you that without breaking existing integrations.