Postback Security

HMAC Hashing

To ensure that all postbacks are genuine and originate from TarGo, each callback request includes a security signature called a hash. This hash is automatically appended to the end of every postback URL we send.

How It Works

1. You define your postback URL, for example:

https://yourpostback.com/pb?uid={user_id}&reward={reward}

1. TarGo replaces the placeholders ({user_id}, {reward}, etc.) with real values.

2. TarGo then temporarily appends &hash= with an empty value to the end of the URL.

3. TarGo computes the signature:

hash = HMAC-SHA1( full_callback_url_with_hash_empty , app_secret_key )

1. TarGo replaces the empty hash value with the computed hash and sends the final callback to your server.

Example Final Request:

https://yourpostback.com/pb?uid=abc123&reward=500&hash=dbcd6bb892842a52b4fca9bec36cd4b

⚠️ Important Notes

Rule	Description	Why It Matters
Do NOT modify the URL	Verify the hash using the exact URL string received	Any change results in a different hash and failed validation
Do NOT reorder query parameters	Keep parameter order exactly as TarGo sent it	Parameter order affects the hash value
Do NOT encode or decode the URL	Do not apply decode, encode, or format conversions	Encoding changes characters and invalidates the hash
Keep hash= placeholder but empty during verification	Replace hash=VALUE → hash= before hashing	The hash is computed on the URL with hash value removed
Use HMAC-SHA1 Algorithm	Hash is always HMAC-SHA1(URL, secret_key)	Other algorithms will not match the signature
Compare using a timing-safe compare	Use hash_equals() / timingSafeEqual()	Prevents timing-based forgery attacks
Use full URL including domain	Hash input must include scheme, host, path & query	Hash must match TarGo’s full signed string

Hashing Code Examples

PHP

<?php

$secretKey = "YOUR_SECRET_KEY";

// Build full raw URL
$fullUrl = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http")
         . "://{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";

$receivedHash = $_GET['hash'] ?? '';

// Remove hash value → leave "hash="
$urlWithoutHash = preg_replace('/hash=[A-Za-z0-9]+/i', 'hash=', $fullUrl);

$expectedHash = hash_hmac('sha1', $urlWithoutHash, $secretKey);

if (hash_equals($expectedHash, $receivedHash)) {
    http_response_code(200);
    echo "OK";
} else {
    http_response_code(403);
    echo "INVALID";
}

Python

IP Whitelisting

You can restrict the callbacks to be accepted only from our sever IP address(es). Please whitelist the following IP(s) and regularly check back to find possible changes

1.1.1.1