A PTC offer runner that pays only on a real view
Open the target, run the timer, verify server-side, credit once. The four steps and the checks that belong to each.
Tagged “ptc”
4 entries
Enforce a minimum dwell that a script cannot skip
The countdown belongs to the client, so the client will lie. Bind the timing to a signed server token and check it when the claim arrives.
Handle an offerwall postback without paying twice
Signature check, unique constraint, credit inside a transaction. Networks retry postbacks, so the same completion will arrive more than once.
Verify a Cloudflare Turnstile token server-side
The widget on the page proves nothing on its own. This is the server check, written to fail closed on every error path.