Sharklio Integration Options: Link, Iframe, API and SDKs

What are the Sharklio integration options?

Sharklio is a pay-per-result affiliate network, and you run it in one of three ways: the offerwall, a hosted wall you open with a signed link, embed in an iframe, or open from a floating button; the Offers API, which gives your server the offers as JSON for your own design; and the mobile SDKs for Android, iOS, Flutter, React Native and Unity, which open the same offerwall as a native screen. Every app has all three at once, and rewards always reach your server the same way: a signed server-to-server postback for every credit and every reversal.

Below, every option side by side, with a link to the full guide for each. New to the model? Start with How the Sharklio offerwall works.

Which integration fits your property?

Effort is a rough guide for a developer who already has user accounts and a server.

Every row also needs one postback handler on your server, which serves every integration.

The offerwall: one signed link, three ways to show it

The offerwall is a complete offer page that Sharklio hosts, in your currency and Design tab colors. Users get Earn, My offers and My rewards at the top, and each offer in My offers has a Report button for a missing reward.

The signed offerwall link

https://wall.sharklio.com/{APP_ID}?user_id={USER_ID}&hash={HASH}

The user ID is your own ID for the signed-in user, 1 to 100 characters from A-Z a-z 0-9 . _ @ : + -, and it must never change. The hash is an HMAC-SHA256 of the user ID with your link hash salt, in lowercase hex, built on your server. HMAC is the keyed hash defined in the IETF’s RFC 2104; here it stops anyone from editing the user ID to open someone else’s wall. Link security is on by default.

The link works anywhere: a menu item, a new tab, a mobile WebView, or a Discord or Telegram message. See How to add an offerwall to a Discord bot and Add an offerwall to a Telegram Mini App. For a single offer, use a direct offer link, signed the same way.

The iframe on your website

The Integration tab has ready-made iframe code with your link. The frame is as tall as the screen and scrolls on its own; keep its style, or browsers show a 300 by 150 pixel box. For safety, the wall loads inside frames and pop-ups only on https pages of the website you registered for the app and its subdomains, using the Content Security Policy rule that MDN describes as the list of valid parents that may embed a page. That website is the Website or app URL you enter when you create the app, and it cannot be changed later. Offerwall integration: iframe, link or API? compares the web options in depth.

The floating button (embed.js)

One script tag adds a corner button that opens the offerwall in a pop-up over your page:

<script src="https://wall.sharklio.com/embed.js" async
  data-button-url="https://wall.sharklio.com/{APP_ID}?user_id={USER_ID}&amp;hash={HASH}"
  data-button-text="Earn rewards"></script>

• data-button-url must be the user’s signed link, starting with https://wall.sharklio.com/, or no button appears.
• Optional: data-button-text (up to 40 characters), data-button-color (six-digit hex; the text turns dark or light to stay readable) and data-button-position (right or left).
• Have your own rewards menu item? Add data-sharklio-open to it and load the script once, or call Sharklio.open(link) from your JavaScript.

The iframe’s domain rule applies here too. See Add a floating Earn button to any website.

The Offers API: offers as data, in your own design

GET https://api.sharklio.com/v1/offers?user_id={USER_ID}&country=US&device=android
Authorization: Bearer YOUR_API_KEY

user_id and country are required, plus device or the user agent as ua. Each offer has a title, description, steps (goals), the reward already in your currency, your payout in US dollars, an image and a start_url. The answer also has history_url, the user’s My offers page.

You get the same offers as your offerwall, minus those the user already completed or cannot do again yet. The rest is your work: cards that explain each offer, a button that opens start_url unchanged, a visible link to My offers, and fresh lists. Caching one user’s list for 1 to 5 minutes is fine, and each app can make 600 requests per minute, Offers API and SDK sessions together. See Build your own offerwall with an Offers API and the Offers API docs.

The mobile SDKs: a native screen, with no key in the app

1. The user taps your Earn button, and your app asks your server for a session.
2. Your server calls POST https://api.sharklio.com/v1/session with your API key and the user ID, and passes the token to the app.
3. The app opens the offerwall with the token in a native screen.
4. Rewards reach your server through your postback, as with the link.

A token works once and for 10 minutes, so create one each time the wall opens. Only the App ID goes into your app. The SDKs open offers in the Play Store, the App Store or the browser, use your title and colors from the Design tab, and send opened, closed and error events, which are for your interface only.

Versions are from the SDK docs, checked on November 2, 2026. The Flutter, React Native and Unity packages use the native Android and iOS SDKs inside. Expo’s docs describe a development build as your own version of Expo Go in which you can use any native library, which is why the package needs one.

An SDK also changes your store privacy answers. Apple’s App privacy details page says they must cover third-party partners whose code you add, and Google’s Data safety help page says the same for third-party SDKs (checked on November 2, 2026). The iOS and Android SDK docs list what to declare. Other engines have no dedicated SDK: see How to open an offerwall in a WebView safely and the Godot guide.

What every integration shares

If a secret may have leaked, Replace your keys on the same tab makes a new one, and the old one stops working right away. See Where to store API keys securely. The app’s other settings apply everywhere too:

• Currency: the currency name, conversion rate, split to user, rounding and any time-limited bonus apply to every integration. See Set up your app currency.
• Hidden offers: an offer hidden on the Offers page is left out of the offerwall, the floating button, direct links and the Offers API.
• Sub IDs: sub1 to sub5 on the link, the API request or the SDK session come back in the postback.
• Who sees offers: offers depend on country and device. VPN, proxy, Tor and data center connections get a block page wherever the wall or an offer page opens, SDKs and API start links included. End users must be at least 16, with parental permission under 18.

Postbacks and the Reporting API

You add one postback URL in the app’s Postback tab, and Sharklio sends it a GET request for every event:

• Status 1 is a credit: add {reward} once per {transaction_id}. Status 2 is a reversal of that same transaction: take the reward back if you credited it.
• {hash} is an HMAC-SHA256 of the transaction ID, user ID, reward and status joined with colons, signed with your postback secret key.
• Answer with a 2xx code within 6 seconds. Failures are retried up to 5 times, after about 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours, and every attempt is listed under Reports, Postbacks.
• {integration} says whether the user came through offerwall, api or sdk.

See Postback security and the Postbacks docs for the handler. The Reporting API uses the same API key: /v1/stats groups clicks, credits, reversals, earnings and EPC by day, country, offer, integration or sub ID, and /v1/conversions lists every transaction to match against your postbacks, up to 92 days per request. Start with the Reporting API quick start.

You can combine them

The docs say every app can use all three ways at once. Nothing is chosen when you create the app; the “How will you show the offers?” switch on the Integration tab only changes which setup steps you see. Common mixes:

• An iframe earn page on your website and the SDK in your mobile app, with one balance.
• An Offers API list in your design, linking to My offers on the wall. An offer started from the API is the same as one started on the wall.
• The iframe on the earn page and the floating button on other pages.

Use the same user ID for the same person everywhere. To compare integrations, read {integration}, group the Reporting API by integration, or check Integration status, which shows how many users opened an offer through each one. A property that needs its own currency, design, postback URL or website needs its own app: see Multiple apps in one publisher account.

Test before your first user arrives

Integration status, at the top of the Integration tab, checks your setup without real traffic: Check a link tests a link your server built, or shows the exact link for a user ID; Open as a test user opens the wall as owner-test, not counted as a user; Send a test postback sends a credit or reversal and shows your server’s answer, with a transaction ID that starts with test_. Test from a normal home or mobile connection. Set up with your coding agent on the same tab gives Cursor, Claude Code or GitHub Copilot a prompt with no keys in it. See Integration status explained and How to test your app before it goes live.

Frequently asked questions