This interactive guide explains the campaign types you can offer, how affiliates place your assets, and how to connect tracking and conversions securely. Follow the steps in order.
Choose the campaign goal that fits your store. The technical setup depends on the goal.
Create a product campaign for one product or offer, a banner campaign for visual creative, or a Social Ads campaign for shareable promotions. Enter the actual product page, not just your homepage.
Click: MUNK records the tracked click. Sale: your store sends a server-side conversion after an order is definitively paid. Registration: send a conversion after a confirmed registration with amount 0. Sales and registrations require verified website and API integration.
Upload a banner or product image and provide a clear title, description and terms. Affiliates use their own personal MUNK link as the click destination. Never put your API key in creative assets, HTML or a link.
Open Website & API verification in your dashboard. Choose the HTML file or meta tag method, place the unique verification on your own domain and let MUNK check the website.
Verify website →Create a key under API Keys with the conversion:write scope. Copy it immediately and store it as a secret on your store server, for example as an environment variable or in a file outside the public web root. MUNK cannot show the full key again later.
API keys →The landing page stores munk_click_id server-side with the session, cart or order. The order backend sends a signed postback to MUNK only after definitive payment confirmation. For registrations, use the confirmed-registration hook. Do not put this in browser JavaScript.
Test with your own campaign, test click and test order. Check that the click ID remains linked to the order, the API returns HTTP 201 and the conversion appears as Pending review. Have an administrator check the order.
These are example previews of ad formats an affiliate can place on their website. The final styling depends on the affiliate website. The click destination is always the affiliate’s personal MUNK tracking link.
Placement example: Banner block
Wireless audio with clear sound, long battery life and a compact charging case.
View offer ↗Placement example: Content / mobile feed
Placement example: editorial text block
Social Ads creative + personal MUNK tracking link
ⓘ Affiliate link: the website owner may earn a commission if you buy through this link.
The API key, HMAC signature and postback code belong exclusively in your server-side backend. Never in the browser, page source, public repository, image or affiliate link.
The API key, HMAC signature and postback code belong exclusively in your server-side backend. Never in the browser, page source, public repository, image or affiliate link.
Prefer hosting environment variables. If you use a configuration file, place it outside public_html, www or httpdocs and restrict file permissions.
MUNK_API_KEY=munk_YOUR_PRIVATE_API_KEYThe visitor arrives through the MUNK link with munk_click_id. Validate its format and store it server-side. Preferably attach it to the cart/order so it is not lost during checkout.
<?php
if (session_status() !== PHP_SESSION_ACTIVE) {
session_start();
}
$clickId = (string) ($_GET['munk_click_id'] ?? '');
if (preg_match('/^[a-f0-9]{32}$/', $clickId)) {
$_SESSION['munk_click_id'] = $clickId;
}The example below shows the core signing process. Integrate it into your store order-status hook. The exact hook depends on your ecommerce software. Never send for a failed, cancelled or merely created order.
<?php
$apiKey = getenv('MUNK_API_KEY');
$timestamp = (string) time();
$payload = json_encode([
'click_id' => $storedClickId, // stored server-side
'conversion_ref' => $uniqueOrderId, // unique order ID
'conversion_type' => 'sale', // or 'registration'
'gross_amount' => $verifiedTotal // registration: 0
], JSON_UNESCAPED_SLASHES);
$signature = hash_hmac('sha256', $timestamp . '.' . $payload, $apiKey);
$ch = curl_init('/api/v1/conversion.php');
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $payload,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CONNECTTIMEOUT => 5,
CURLOPT_TIMEOUT => 10,
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'X-Munk-Key: ' . $apiKey,
'X-Munk-Timestamp: ' . $timestamp,
'X-Munk-Signature: ' . $signature
]
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($response === false) { error_log('MUNK postback transport failed'); }
curl_close($ch);
// Store the result; retry with the SAME conversion_ref on timeout.POST /api/v1/conversion.phpHeaders: X-Munk-Key, X-Munk-Timestamp, X-Munk-Signature · Scope: conversion:write · HMAC-SHA256 of timestamp.raw_json_body
201 201 — received; conversion is Pending review. This is not a final commission yet.
401 401 — check the API key, timestamp and HMAC signature.
404 404 — click ID not found or does not belong to your advertiser account.
409 409 — campaign is ineligible, budget unavailable or duplicate order reference.
422 422 — check the fields and conversion type.
429 429 — API rate limit reached; retry later using the same unique order reference.
API key on the backend only; never in HTML or JavaScript.
Use HTTPS and validate the 32-character click ID.
Store click ID server-side and never trust revenue supplied by the browser.
Use a stable unique order reference and prevent duplicate postbacks.
Send only after payment confirmation or confirmed registration.
Never log API keys, signatures or full customer details.
Revoke a leaked key immediately and create a new one.
An API postback is a statement from your store server. Without an independent payment-provider connection, MUNK cannot independently prove that funds were received. Conversions are therefore first recorded as Pending review. The campaign payout determines the affiliate commission; gross_amount is order information and does not automatically set the commission.
Domain verified, API tested and a test order checked? You can now submit your campaign for review.