By default, Aftrad accepts any conversion postback that an advertiser sends to their postback URL, as long as the required parameters are present. Secure token validation adds an extra layer of security by verifying that each incoming conversion genuinely originates from the expected advertiser, and rejecting any requests that cannot be authenticated.
How it works
When you generate a secure token for an advertiser, Aftrad automatically adds a securetoken parameter to the postback URL the advertiser uses to send conversions to Aftrad:
https://[event-domain]/api/v1/events?click_id={click_id}&...&securetoken={securetoken}The advertiser must include this parameter in every postback they send to Aftrad. When a conversion arrives, Aftrad checks whether the token is valid and active before processing it.
You can control how strictly this is enforced using the Require secure token toggle.
Managing secure tokens
Go to the advertiser's Postback URL tab and scroll down to the Secure tokens section.
Generating a token
Click + Generate and enter a label to identify the token (e.g. Default, Token002).
Click Generate.
The token value is shown once at this point — copy it immediately using the Copy token button. For security reasons, the full token value will not be shown again once you close this dialog.
Copy this token now. This is the only time the full value will be visible.
Once saved, the token appears in the Secure tokens list, and the securetoken parameter is automatically added to the Advertiser's postback URL and parameter table.
Token list
The token list shows all tokens for the advertiser, with the following information:
Label — the name you assigned when generating the token
Token — a masked preview of the token value
Created at — the date the token was generated
Status — Active or Revoked
Multiple tokens can be active simultaneously. This allows you to safely rotate tokens: generate a new token, share it with the advertiser, wait for them to update their postback configuration, and only then revoke the old token.
Default token
When more than one active token exists, exactly one is designated as the default. The default token is the one shown in the securetoken row of the parameter table above, and is the value substituted in the postback URL displayed in the UI.
The star (★) icon next to a token indicates that it is the current default. To set a different token as default, click the star icon on that token.
If the current default token is revoked, the next active token is automatically promoted to default.
Revoking a token
Click the delete icon next to a token to revoke it. A confirmation modal will appear — confirm by clicking Revoke token.
Once revoked, the token is immediately invalid for incoming conversions. Revoked tokens remain visible in the list with a Revoked status.
Require secure token
The Require secure token toggle controls how strictly token validation is enforced.
Toggle state | No securetoken in postback | Valid active token | Invalid or revoked token |
OFF (default) | Conversion accepted | Conversion accepted | Conversion rejected |
ON | Conversion rejected | Conversion accepted | Conversion rejected |
When the toggle is OFF, secure token validation is permissive — conversions without a token are accepted normally, but if a token is included it must be valid. This mode is recommended during the transition period while distributing the token to the advertiser.
When the toggle is ON, enforcement is active. Every conversion must include a valid, active token or it will be rejected immediately.
Important: before enabling the toggle, make sure the advertiser has already updated the postback calls they send to Aftrad to include the securetoken parameter. Enabling enforcement before the advertiser is ready will cause their conversions to be rejected.
Rejected conversions
Conversions rejected due to secure token validation are logged in Advertiser Events with status Rejected and reason Invalid or missing secure token. They are visible alongside all other events in the event log.