Build with ToroAds Lockers, Links & API

Getting started

Three steps from sign-up to your first paid conversion. Everything after that is configuration.

Content Locker

A locker gates any part of your page (a download, a video, an article, a coupon) behind one completed offer. Integration is a single script tag; the loader handles the overlay, the offer list, the click and the unlock poll for you.

1. Drop in the loader

Every locker exposes its own loader URL, built from its public code. Copy the exact line from the locker’s embed page.

<script src="https://cdn.toroads.com/cl/js/{locker_id}"></script>

2. Choose how it opens

The load method decides who starts the opening, and the load delay decides how long after that. They are not two knobs on one timer.

3. Trigger it yourself (javascript method)

Each locker gets its own global function, derived from its public id; it is not a shared toro_load(). The embed page prints the real name; here it is vd7. The panel gives you the four snippets below and they are the whole set: pick one, paste it once, change the number if it has one.

<script>vd7();</script>

<script>setTimeout(function() { vd7(); }, 5000);</script>

<button onclick="vd7()">Unlock Content</button>

<button onclick="setTimeout(function() { vd7(); }, 5000)">Unlock Content</button>

4. Inline template

For an inline locker there is no trigger question: the container is the trigger. Put it where the locker should render.

<div id="captcha-locker"></div>
<script src="https://cdn.toroads.com/cl/js/{locker_id}"></script>

Smart Links & Direct Links

A link is the lightest integration we have: no script, no key, nothing to embed. You share a URL, we pick the best-paying eligible offer for that visitor’s country and device, record the click, and redirect. Both prefixes below hit the same resolver, so links already in circulation keep working.

Link format

https://your-domain.com/sl/{link_id}
https://your-domain.com/dl/{link_id}

Passing your own user id

Direct Links are templates you fill in yourself. They carry a single {user_id} macro: substitute your end user’s identifier before you publish the link, and that value comes back to you on the conversion postback.

# template as shown in the dashboard
https://your-domain.com/dl/{link_id}/{user_id}

# what you publish for user 4821
https://your-domain.com/dl/{link_id}/4821

Offerwall

A hosted, brandable wall of offers for your app or site, denominated in your own virtual currency. There is nothing to sign and nothing to compute. The only URL you need is the one on your app’s page in the dashboard; your api_secret is not involved here, it is used only to verify the postbacks we send you.

<iframe
  src="https://titan.toroads.com/123/end-user-42"
  style="border:0;width:100%;height:720px"
  title="Offers"></iframe>

Substitute your App ID for 123 and your own end-user id for end-user-42. You can also simply link to that URL instead of framing it.

Domains

Your lockers and links are served from a host you choose. There are two kinds and you can have both: a free subdomain we generate for you in one click, and your own custom domain. Both are managed in one place: Custom Domains, reached from the button in the header of the Content Locker or Smart & Direct Link tool, or at /tools/custom-domains.

Free subdomain

Under Free Subdomains, press Generate. You get a short, random hostname served from our edge with HTTPS already working, and it is yours for good: the label is never rotated or re-pointed once issued.

One of them is the default, used whenever a locker or link does not name a host itself. You can disable any of them, and whatever was being served from it stops until you switch it back on.

Your own domain

Use a subdomain, not your apex. Your main site stays untouched and you can point the subdomain away again at any time.

go.yoursite.com
unlock.yoursite.com
links.yoursite.com

Add the hostname and it starts pending. The panel then prints the exact DNS record for your domain: copy it from there rather than from any guide, including this page. Create that record at your registrar, press refresh, and the certificate is issued for you. When the domain flips to connected, new lockers and links pick it up, and anything you already published on the old hostname keeps working.

Each domain carries two switches, CL and SL, for whether Content Locker and Smart Link traffic may use it, so one hostname can be kept for one product. A platform-owned hostname cannot be connected, and a hostname belongs to one account at a time, which is what stops anyone else serving their content on your domain.

Which host a snippet uses

The embed panel has a domain picker listing your own domains and your free subdomains, and the host in the snippet is whichever you picked, so choose before you copy. With neither connected there is nothing to build a snippet against, and the panel asks you to connect a domain first.

Full domain walkthrough

Offer Feed API

Returns the offers eligible for an app, already filtered by country, device and the app’s own configuration, so you can render offers in your own UI. All endpoints return application/json.

Base URLs

Offer feed (v1 / v2 / v3):  https://api.toroads.com
Everything else:            https://your-domain.com/api

The /api prefix is not part of the path on the feed domain. The click redirects and offerwall endpoints keep the prefix on your main domain.

Authentication

Versions

Query parameters

Automatic targeting on v3

v3 returns at most 10 offers, boosted and premium inventory first. A parameter you leave out can be answered from the request itself, but only when the request comes from a browser, detected from User-Agent and Accept.

Your backend is deliberately excluded: your server’s location describes your infrastructure, not your visitor. Always pass ip (or country_code) and platform explicitly from your server.

Example request

curl -H "Authorization: Bearer APP_API_KEY" \
  "https://api.toroads.com/v2/offers/123/end-user-42?country_code=US&platform=android"

Example response: 200 OK

{
  "offers": [
    {
      "id": 1234,
      "name": "Play Game X: reach level 10",
      "description": "Install and reach level 10 within 7 days.",
      "image": "https://cdn.example.com/offers/1234.png",
      "offer_type": "CPI",
      "payout": "2.40",
      "countries": ["US", "CA", "GB"],
      "devices": ["android", "ios"],
      "url": "https://your-domain.com/api/redirect/eyJpdiI6Ii4uLiJ9"
    }
  ]
}

Field notes

• payout is a string with two decimals, already adjusted for the app’s custom rate.
• devices is always non-empty, drawn from android, ios, web. An unrestricted offer lists all three rather than an empty array, so there is no empty case to branch on, and the values are exactly the tokens platform accepts.
• url is a ToroAds tracking link: send the user there and we record the click, then redirect to the offer.
• v2 additionally includes points, is_game, incent and events. v3 omits those.
• events is the goal ladder and is present only on offers with more than one goal. Branch on the key being absent, not on an empty array.
• Network-wide performance metrics (EPC, conversion rate, click volume) are never returned by the feed. Your own figures are on the dashboard and Statistics pages.

Errors & status codes

Authentication and app-state failures answer with { "error": "<reason>" }.

Every failure carries a short error string describing what to fix. If a feed call is refused and the reason is not obvious from your own configuration, contact support with the App ID and the time of the call.