Skip to main content

Quickstart

This walks through the most common first integration: a headless scratch card, from an empty project to a revealed reward. Roughly 30 minutes once you have credentials.

Prerequisites

You need a CHANNELID, an exchanged key pair, whitelisted server IPs, and at least one campaign configured in UAT. If you don't have these yet, start with Onboarding.

What you'll build​

Step 1 — Sign a request​

Every server-to-server call on the Rewards Center API uses the same envelope: your channel, a signature, and a base64 payload.

Envelope shape
{
  "CHANNELID": "YOURCHANNEL",
  "SIGN": "<base64 RSA signature over the BDATA string>",
  "BDATA": "<base64 of your JSON payload>"
}

The signature is computed over the base64 BDATA string itself, using SHA256withRSA with your private key.

import java.security.*;
import java.util.Base64;
import java.nio.charset.StandardCharsets;

public String buildEnvelope(String payloadJson, PrivateKey privateKey, String channelId)
    throws Exception {
  String bdata = Base64.getEncoder()
      .encodeToString(payloadJson.getBytes(StandardCharsets.UTF_8));

  Signature signer = Signature.getInstance("SHA256withRSA");
  signer.initSign(privateKey);
  signer.update(bdata.getBytes(StandardCharsets.UTF_8));   // sign the base64 string
  String sign = Base64.getEncoder().encodeToString(signer.sign());

  return String.format(
      "{\"CHANNELID\":\"%s\",\"SIGN\":\"%s\",\"BDATA\":\"%s\"}", channelId, sign, bdata);
}

Full details, including how to verify Cheggout's response signature, are in The signed envelope.

Step 2 — Get a reference token​

Run this hourly on a schedule, not per request. Cache the result.

BDATA payload (before base64)
{ "bName": "YOURCHANNEL" }
curl -X POST https://rewardscenter-uat.cheggout.com/api/getSecuredReferenceToken \
  -H "Content-Type: application/json" \
  -d '{
        "CHANNELID": "YOURCHANNEL",
        "SIGN": "<signature>",
        "BDATA": "eyAiYk5hbWUiOiAiWU9VUkNIQU5ORUwiIH0="
      }'

Decode BDATA from the response to get your token:

{ "referenceKey": "REPLACE_WITH_TOKEN", "expireDate": "<expiry>" }

Tokens are opaque credentials — no format is documented, so store the value and do not parse it.

The key is bName here

This endpoint reads bName — case-sensitively. GetAuthToken reads channelName instead. Use the exact key each endpoint's reference page documents.

See getSecuredReferenceToken.

Step 3 — Create a card when something happens​

When your user completes a qualifying event, tell Cheggout. This is a plain JSON body with the reference token as a bearer credential — no envelope.

curl -X POST https://rewardscenter-uat.cheggout.com/api/GetReward \
  -H "Authorization: Bearer <referenceKey>" \
  -H "Content-Type: application/json" \
  -d '{
        "channelName": "YOURCHANNEL",
        "virtualId": "pub_8f14e45fceea167a",
        "triggerEventType": "YOURCHANNEL_CAMPAIGN",
        "extTransactionId": "PUB_TXN_20260731_000117",
        "amount": 499.00,
        "dateandtime": "31072026141530"
      }'
Response
{
  "status": true,
  "message": "success",
  "rewards": [
    {
      "rewardId": 45144,
      "isAlreadyRewarded": false,
      "createdDateTime": "2026-07-31 14:15:31.000",
      "trackLink": ["https://tracking.cheggout.com/Tracker/Impression?..."]
    }
  ],
  "clicktrack": ["https://tracking.cheggout.com/Tracker/clicks?..."]
}

A card now exists. No reward has been assigned yet — that happens at reveal.

"rewards": [] with status: false is a normal outcome meaning "not eligible this time". Handle it as a non-event, not an error.

Fire the trackLink URL when the card becomes visible.

See GetReward.

Step 4 — Get a user token​

Revealing needs a user-scoped token, which is a different token from step 2.

BDATA payload
{ "virtualId": "pub_8f14e45fceea167a", "channelName": "YOURCHANNEL" }
curl -X POST https://rewardscenter-uat.cheggout.com/api/GetAuthToken \
  -H "Content-Type: application/json" \
  -d '{"CHANNELID":"YOURCHANNEL","SIGN":"<signature>","BDATA":"<base64>"}'

Decoded response:

{ "token": "REPLACE_WITH_TOKEN", "expireDate": "<expiry>" }

See GetAuthToken.

Step 5 — Reveal the reward​

When the user scratches, reveal. Cheggout picks the reward from the campaign pool at this moment.

curl -X POST https://rewardscenter-uat.cheggout.com/api/FetchRewardInfo \
  -H "Authorization: Bearer <authToken>" \
  -H "Content-Type: application/json" \
  -d '{
        "CHANNELID": "YOURCHANNEL",
        "BDATA": "<base64 of {\"rewardId\":\"45144\",\"virtualId\":\"pub_8f14e45fceea167a\",\"channelName\":\"YOURCHANNEL\"}>"
      }'

The response BDATA decodes to the reward — offer title, coupon code, terms, redemption steps, imagery and its own click-tracking URLs.

Fire the click URL when the user taps through to redeem.

Reveal exactly once

Re-revealing the same rewardId does not return the reward again. Store what you get, and use GetAllScratchCardsByUserId to re-display it later.

See FetchRewardInfo.

Step 6 — Show reward history​

For a "My Rewards" screen, list everything the user has — unscratched cards first, then revealed rewards.

curl -X GET "https://rewardscenter-uat.cheggout.com/api/GetAllScratchCardsByUserId?page=1&limit=20" \
  -H "Authorization: Bearer <authToken>"

Or skip building the screen entirely and launch the hosted rewards experience.

Checklist before you call it done​

  • Reference token is fetched on a schedule and cached, not per request
  • extTransactionId is unique per event and stored on your side
  • "rewards": [] is handled as "no reward", not as a failure
  • Impression fires on display, click fires on scratch or tap
  • Revealed rewards are persisted — reveal is one-shot
  • Keys and tokens live server-side only

Next​