Flutter SDK

How it works

1. When the user taps your Earn button, your app asks your own server for a session.
2. Your server calls POST /v1/session with your API key and the user’s ID, and passes the token to the app.
3. The app calls Sharklio.open(token). The plugin opens the offerwall in a native screen.
4. Rewards reach your server through your postback, exactly as with the offerwall link. See Postbacks.

A token works once and for 10 minutes. Create a new one each time the user opens the offerwall. Your API key and your link hash salt stay on your server, so nothing in your app can be used to open another user’s offerwall.

Platform	Status
Android 5.0 (API 21) or newer	Supported. The plugin uses the Android SDK inside.
iOS 13 or newer	Supported. The plugin uses the iOS SDK inside.

Install

Flutter 3.27 or newer. The plugin is in the Sharklio package repository. Add it to your pubspec.yaml and run flutter pub get:

dependencies:
  sharklio_offerwall:
    hosted: https://sharklio.com/pub
    version: ^1.1.0

On iOS there is nothing to add: the plugin brings the Sharklio iOS SDK with it, for CocoaPods and for Swift Package Manager. Build with Xcode 16 or newer. For the App Store, see App Store privacy details.

On Android there is nothing else to add: the plugin brings the Sharklio Maven repository, the Android SDK and its R8 rules with it. If your android/settings.gradle blocks project repositories (repositoriesMode), add maven { url = uri("https://sharklio.com/maven") } to its dependencyResolutionManagement repositories.

Create a session on your server

Send the fields as a form or as JSON, with your API key in the Authorization header. This is the same request as for the Android SDK.

Field	Description
user_idrequiredstring	The same user ID you receive in postbacks. 1 to 100 characters: letters, numbers, and . _ @ : + -.
sub1 to sub5optionalstring	Your own tracking values. They are returned in the postback as {sub1} to {sub5}.

Errors: 400 invalid_user_id, 401 invalid_api_key, 403 app_not_live or user_blocked (do not show the offerwall), 405 method_not_allowed, 429 rate_limited (retry after the time in the Retry-After header).

Open the offerwall

Call init once with the App ID from the Integration tab. Then open the offerwall with a fresh token from your server.

import 'package:sharklio_offerwall/sharklio_offerwall.dart';

void main() {
  WidgetsFlutterBinding.ensureInitialized();
  Sharklio.init('YOUR_APP_ID');
  runApp(const MyApp());
}

// When the user taps Earn, with a token from your server:
await Sharklio.open(token);

open never throws for offerwall problems. They arrive as events, see Events.

Branding

The top bar of the offerwall screen shows the Sharklio mark, like the offerwall itself, with your offerwall title and colors from the Design tab of your dashboard. To set the title or color yourself, or to hide the mark, pass options:

await Sharklio.open(
  token,
  options: const SharklioOptions(
    title: 'Earn coins',
    toolbarColor: Color(0xFF004ABB),
    showLogo: false,
  ),
);

Events

Sharklio.events.listen((SharklioEvent event) {
  switch (event) {
    case SharklioOpened():
      break;
    case SharklioClosed():
      refreshBalance();
    case SharklioErrorEvent(:final SharklioError error):
      debugPrint('${error.code.name}: ${error.message}');
  }
});

Prefer callbacks? Sharklio.setListener(SharklioListener(onOpened: ..., onClosed: ..., onError: ...)) works like the Android listener.

Event	When
SharklioOpened	The offerwall finished loading.
SharklioClosed	The user closed the offerwall. A good moment to load the user’s balance from your server.
SharklioErrorEvent	notInitialized, invalidAppId, invalidToken, tokenExpiredOrUsed, network, unsupported, or unknown. Create a new session and try again.

Security

• Create sessions on your server only. Never put the API key or the link hash salt in your app, because anyone can read an app’s files.
• Credit rewards only from the signed postback on your server, never from events in the app. Events can be faked on a user’s device.
• Make sure your own endpoint that returns tokens only does so for the signed-in user.

Testing

Before you launch, create a session from your server for a test user ID and open it in a debug build of your app on an Android phone, an iPhone, or the iOS Simulator. Check that the offerwall opens, that an offer opens in the store or the browser, and that the back and close buttons work. Then send test postbacks from Integration status on the Integration tab of your app to check your server. Test on a normal home or mobile connection: on a VPN or a test device in the cloud, the offerwall shows a block page such as VPN detected instead of offers. See Testing.

Clicks that come through the plugin show as sdk in the {integration} postback macro and in the Reporting API, and as Mobile SDK in your dashboard, like the Android SDK.