Verify a shortlink completion with a signed return token
Providers do not postback, so the round trip is the only evidence. Single use, account bound, expiring, minimum dwell, and starting a new run kills the old one.
3 entries
Providers do not postback, so the round trip is the only evidence. Single use, account bound, expiring, minimum dwell, and starting a new run kills the old one.
Open the target, run the timer, verify server-side, credit once. The four steps and the checks that belong to each.
The countdown belongs to the client, so the client will lie. Bind the timing to a signed server token and check it when the claim arrives.