Client Side SDK

How to secure your campaign with Authorized Conversions

When running a referral program that grants valuable rewards, protecting your campaign against fraud is critical. Enabling Allow only authorized conversions ensures that conversions are strictly validated by your backend server or official integrations, preventing users from spoofing actions on the client side.

What is Authorized Conversions?

Allow only authorized conversions is a campaign security setting in Viral Loops. When enabled, Viral Loops will only count conversion events authenticated with your private API token.

Any conversion triggers coming directly from the browser or client-side scripts are automatically rejected and ignored.

Why Enable This Feature?

Client-side code running in a user's browser (such as JavaScript SDK calls or URL page visits) can theoretically be inspected or triggered by tech-savvy users attempting to exploit your referral rewards.

Enabling authorized conversions provides key protections:

  • Prevents Fraud & Exploits: Block users from manually triggering conversion events via browser developer tools.
  • Guarantees Real Revenue/Events: Ensure rewards are distributed only when an action is confirmed by your backend or payment processor.
  • Protects Campaign Budget: Avoid paying out rewards for fake signups or unverified purchases.

How It Affects Conversion Tracking Methods

When Allow only authorized conversions is toggled ON, client-side methods are automatically disabled:

  • JavaScript SDK: Disabled (client-side calls are ignored).
  • Page Visit: Disabled (automatic URL visit tracking is ignored).
  • Using a Private API Call: Active (server-to-server requests using your secret API token).
  • Stripe / Native Backend Integrations: Active (secure server-authenticated webhooks).

How to Enable Authorized Conversions

  1. Navigate to your Viral Loops Campaign Dashboard.
  2. Go to the Setup tab under your campaign's conversion settings.
  3. Toggle on Allow only authorized conversions.
  4. Ensure your server-side API calls include your private apiToken in the headers/payload.

API Call Format (v3)

curl --request POST \
  --url [https://app.viral-loops.com/api/v3/campaign/participant/convert](https://app.viral-loops.com/api/v3/campaign/participant/convert) \
  --header 'accept: application/json' \
  --header 'content-type: application/json' \
  --header 'apiToken: <YOUR_API_TOKEN>'

Related articles

Updated about 1 hour ago

Did this page help you?