Content Locker

Gate a page, download or form behind a short list of offer completions. Visitors unlock by finishing the required offers.

Use the iframe method. The JavaScript overlay loader is currently not working on this build — it points the overlay at a URL the server does not serve, which leaves a full-screen overlay containing a 404. Details in Method A.

Create a locker

Go to Content Locker in the publisher sidebar and create a locker.
Set a name and choose how it loads.
Set conversions required — between 1 and 5 offers.
Pick the desktop and mobile themes offered by your operator. Both are required.
Optionally set a content URL — the page users are sent to once they unlock.
Save and copy the locker's UUID.

Settings

Setting	Required	Notes
Name	Yes	Up to 255 characters. Shown to you, not to visitors.
Load method	Yes	`on_load` or `onclick`. See Method A for what this currently affects.
Conversions required	Yes	Whole number from 1 to 5.
Payout threshold	Optional	Only offers paying at least this much are offered. Leave empty for no filter.
Access time	Optional	Minutes an unlocked session stays unlocked.
Desktop / mobile theme	Yes	Both are required. Chosen from the templates your operator has published.
Desktop / mobile title and description	Optional	Heading and sub-heading shown above the offer list.
Content URL	Optional	Where the visitor is sent after unlocking. If set, the unlock page redirects there after three seconds.

Offer selection is handled by the platform: the visitor sees the highest-paying offers available for their detected country, filtered by your payout threshold, limited to the number of conversions you required. You do not choose individual offers.

Method B: Iframe embed — recommended

Embed the locker in the page that holds the protected content. This works reliably.

<iframe
  src="https://preads.hansaldev.com/content-locker/YOUR_LOCKER_UUID/show?uid=YOUR_USER_ID"
  width="100%" height="800px"
  frameborder="0">
</iframe>

The same URL works as a direct link if you would rather send visitors to it:

https://preads.hansaldev.com/content-locker/YOUR_LOCKER_UUID/show?uid=YOUR_USER_ID

Parameters

Parameter	Required	Description
`uid`	Yes	Your unique ID for this visitor. This is how the locker knows who is unlocking.
`fp`	Optional	A device fingerprint value, if you collect one.

Always pass uid. Without it the locker falls back to identifying visitors by IP address. Every visitor behind one network address — a school, a company, a mobile carrier — then shares a single locker session, so one person unlocking unlocks the page for all of them, and their progress is merged.

Method A: JavaScript overlay — currently not working

Preads provides a loader script that injects a full-screen overlay containing the locker:

<script src="https://preads.hansaldev.com/content-locker/js/YOUR_LOCKER_UUID"></script>

The script itself is served correctly, but on this build it loads the locker from /locker/<uuid>/show, and the server does not serve that path — the correct path is /content-locker/<uuid>/show. The result is a dark, full-screen overlay with z-index: 999999 containing a 404 page, and page scrolling disabled. Visitors are left looking at a locked, unscrollable screen.

Two further problems affect this method even if the path is corrected:

The loader registers a message listener for an unlock event so it can dismiss the overlay, but no page in the system ever sends that message. The overlay would therefore never be removed.
The overlay is only injected when the locker's load method is on_load. With onclick the script does nothing at all — there is no handler to bind to.

What to do instead. Use Method B. If you need an overlay effect, render /content-locker/<uuid>/show?uid=... in your own full-screen container, and detect completion with the progress endpoint below. Raise this with your platform operator if you need the built-in loader fixed.

Detecting when a visitor unlocks

The locker sends no browser events. There is no unlock callback, and a postMessage listener will never fire — nothing in the system emits one. Do not build your flow around one.

The supported mechanism is a progress endpoint. The locker page itself polls it, and you can poll it too when you host the locker yourself.

GET https://preads.hansaldev.com/content-locker/YOUR_LOCKER_UUID/progress?session_token=TOKEN

Response on success:

{
  "completed": 2,
  "required": 3,
  "is_unlocked": false,
  "progress_percent": 66.66666666666666,
  "unlock_token": "..."
}

Field	Meaning
`completed`	Offers finished so far.
`required`	Offers needed — your locker's conversion requirement.
`is_unlocked`	Use this. `true` once the requirement is met.
`progress_percent`	Convenience value for a progress bar. Unrounded.
`unlock_token`	Access token for the unlocked session.

Error responses:

Status	Body	Meaning
`422`	validation errors	`session_token` was missing.
`403`	`{ "error": "Invalid session" }`	The token is not valid for this locker.
`404`	`{ "error": "Session not found" }`	The token is valid but no matching session exists — usually because the visitor's identity changed.

The session_token is issued by the locker page itself. If you are embedding the locker in an iframe you will not have direct access to it, so in practice this endpoint is for custom integrations that render the locker themselves. For a plain iframe embed, treat content appearing as the unlock signal, or read the unlock token from the unlocked page in the visitor's browser.

What the visitor sees on unlock

In order of precedence:

If a content URL is set, the page shows the destination and redirects to it after three seconds, with a button to go immediately.
Otherwise, if an unlock code is set, that code is displayed for the visitor to use.
Otherwise an access token is displayed.

Unlocking is recorded per session, so a visitor who returns with the same uid and device fingerprint sees the unlocked state rather than the offer list.

Tracking and reporting

No postback is sent for locker conversions. Locker conversions do not trigger your postback URL. See Postback Setup.
Locker conversions are recorded and appear in your wallet and reporting, but they carry no app association.
Clicks, offers and completions are available on the locker's own Statistics page in the publisher area.

If you need per-user crediting from a locker, drive it from the progress endpoint plus your own records, not from postbacks.

Rate limits

All public locker endpoints share a limit of 60 requests per minute per IP address. This covers the locker page, the loader script, click tracking, the progress endpoint and inbound network postbacks. If several lockers sit behind one shared outbound IP, or you poll the progress endpoint aggressively, you can reach this limit. Poll no more than once every few seconds.

Content moderation

Your operator maintains a banned-word list for locker content. If your locker's title or description matches a banned word it may be suppressed automatically. If a locker you created behaves as though its content is hidden, ask your operator whether it has been moderated.

Troubleshooting

Symptom	Cause and fix
`404` on the locker URL	Wrong UUID, or the locker is inactive. Copy the UUID from the locker list rather than hand-typing it.
Full-screen dark overlay with an error inside	You used Method A. Switch to the iframe method.
One visitor unlocks it for everyone	`uid` was not passed, so visitors are grouped by IP. Pass a unique `uid`.
Visitors must re-unlock on every visit	They are arriving with a different `uid` or device fingerprint each time, so the unlocked state is not recognised. Keep `uid` stable.
Visitors see fewer offers than required	Not enough offers matched their country or your payout threshold. Lower the threshold.
A locker cannot be created by an administrator	Correct. Administrators can list, view, delete, change status and reverse conversions, but lockers are created by publishers.
Preview shows offers and amounts that look invented	The template preview substitutes sample offers when none match your filters. Do not rely on preview data.
Progress endpoint returns `403`	The session token does not belong to this locker.
Progress endpoint returns `404`	No session matches the token — the visitor's identity changed.