What is Cloakly

In performance advertising, ad networks (such as Google Ads, Meta, TikTok, and Microsoft Advertising) deploy automated crawlers, headless browser clusters, and manual reviewers to inspect campaign landing pages. Concurrently, competitive intelligence tools (such as AdPlexity, SpyOver, and Anstrex) constantly scrape advertisements to steal high-converting funnels.

Cloakly acts as an intelligent traffic gateway:

Traffic Sources

Cloakly Pro includes specialized heuristics and pre-configured crawler databases for every major digital acquisition channel:

Integration

Cloakly supports three primary integration methodologies depending on your hosting stack:

• PHP Zero-Footprint Integration (Recommended): A single, lightweight index.php file uploaded directly to your server root. It intercepts the HTTP request before any HTML is sent to the client. Zero external cloaker URLs or footprints are exposed.
• Reverse Proxy Integration: Cloakly runs on your front-end host, internally fetching and streaming the remote Money Page or Safe Page via cURL while keeping your domain visible in the browser address bar.
• Client-Side JavaScript Integration: An asynchronous JavaScript tag embedded into static hosting platforms (such as Shopify, Webflow, or static Jamstack sites) where server-side PHP cannot run.

System Requirements

The Cloakly client script is engineered to run on virtually any modern web hosting environment with minimal resource overhead:

Hosting

The reputation of your web host directly affects ad approval rates. Ad bots check IP subnet ownership and neighbor domains during compliance audits.

CDN (Cloudflare Setup)

If your domain routes through Cloudflare, follow these mandatory configuration steps to prevent IP masking issues and caching interference:

1. SSL/TLS Mode: Set to Full or Full (strict). Never use Flexible, as it causes redirect loops.
2. Header Forwarding: Ensure your web server reads HTTP_CF_CONNECTING_IP instead of the Cloudflare proxy IP. Cloakly automatically checks CF-Connecting-IP, but web server logs also require mod_remoteip (Apache) or set_real_ip_from (Nginx).
3. Disable Rocket Loader: Turn off Rocket Loader under Speed → Optimization, as it defers JavaScript execution and can interfere with hardware JS fingerprinting payloads.
4. Cache Rules: Create a Cache Rule to Bypass Cache for dynamic landing page endpoints (e.g. /*) so every single visitor executes the Cloakly evaluation script dynamically.

Workflow

The end-to-end traffic lifecycle operates sequentially:

Blacklisting & IP Intelligence

Cloakly maintains a dynamically refreshed, high-confidence blacklist database encompassing over 450,000 CIDR ranges and autonomous system numbers (ASNs). Every visitor’s IP address is checked in memory (<1ms) against:

Deep Client-Side Hardware Fingerprinting

When JS Fingerprinting is active, a microscopic, non-blocking script executes in the visitor's browser. It extracts physical hardware and GPU signatures that cannot be spoofed by HTTP request headers alone:

Machine Learning (VLA™ Anomaly Scoring)

Cloakly utilizes a proprietary multivariate anomaly detection engine termed VLA™ (Vision-Language-Action & Anomaly Engine).

• Behavioral Heuristics: Compares the visitor's browsing cadence, scroll acceleration, pointer trajectory, and touch pressure against millions of verified human ad click models.
• Mismatch Cross-Checking: Correlates HTTP header data with physical hardware realities. For example, if an HTTP User-Agent claims to be an iPhone 15 Pro, but the WebGL renderer reports an Intel UHD 630 graphics chip and zero touchpoints, the anomaly score spikes to 100% and routes the visitor to the Safe Page.
• Continuous Adaptive Learning: When ad platforms deploy new inspection clusters or crawler signatures, Cloakly’s global telemetry updates the scoring models across all active accounts in real time.

Our Multi-Tier Hybrid Defense Approach

Rather than imposing a heavy JavaScript delay on every click, Cloakly deploys a tiered progressive filtering strategy:

Cloaking Google (Search, GDN & PMax)

Google employs automated web crawlers (including AdsBot-Google, AdsBot-Google-Mobile, Googlebot, and Feedfetcher-Google) alongside regional manual human policy review teams in California, Ireland, and Singapore.

1. Initial Review Phase: Set the Stream Mode to Review Mode or Safe Page Only prior to submitting your ad for review. Keep this mode active for the first 24–48 hours until impressions begin registering consistently.
2. Auto-Tagging (gclid): Keep Google auto-tagging enabled. Cloakly checks for the presence of the gclid parameter and forwards it automatically to your Money Page.
3. ValueTrack Parameters: Append standard tracking tokens to your final URL:
   Recommended Google URL Format

   https://yourdomain.com/?utm_source=google&utm_campaign={campaignid}&utm_term={keyword}&gclid={gclid}

4. Transitioning to Active: Once your ad is marked "Eligible / Approved" and has accumulated 15–20 genuine impressions, switch the stream mode to Active.

Cloaking Google (Tracking Template)

If your marketing setup requires third-party affiliate trackers (such as Voluum, RedTrack, or Keitaro), configure Google's Tracking Template rather than pointing the ad directly to an affiliate redirect link.

{lpurl}?utm_source=google&utm_medium=cpc&utm_campaign={campaignid}&keyword={keyword}&gclid={gclid}

Google policy auditors evaluate whether {lpurl} (Landing Page URL) and the final destination render identical thematic content during review. Cloakly's zero-redirect execution ensures that the reviewer is greeted by the compliant safe page on the exact landing page URL requested.

Cloaking Facebook (Meta Ads)

Meta (Facebook & Instagram) utilizes automated preview spiders—principally facebookexternalhit/1.1 and Facebot—operating out of Meta's corporate ASN (AS32934). Meta also executes headless rendering tests whenever an ad is created or edited.

Cloaking TikTok

TikTok Ads traffic is 99% mobile (iOS & Android). TikTok's automated crawler network (Bytespider) and manual review squads originate from ByteDance datacenters (AS138699 / AS396986) primarily located in Singapore, the US, and Ireland.

• Require Touchscreen Devices: In your stream filtering settings, enable Allow Only Touchscreen Devices. Desktop-based automated ByteDance crawlers lack touch hardware (maxTouchPoints = 0) and are instantly relegated to the Safe Page.
• Click ID Tracking: TikTok automatically appends ttclid to outgoing clicks. Cloakly captures and relays this token directly to your offer URL for TikTok Events API synchronization.

Cloaking Microsoft Ads (Bing)

Microsoft Advertising inspection spiders (bingbot, msnbot) originate almost exclusively from Microsoft Azure cloud subnets (AS8075).

Cloaking Yandex

Yandex Direct deploys sophisticated automated crawlers (YandexBot, YandexDirectDyn) and inspects landing pages via Yandex Metrika WebVisor telemetry.

• Ensure your Safe Page contains legitimate Russian-language or target-market content if running in CIS territories.
• Keep Russian datacenter ASNs (Yandex LLC AS13238, Selectel, Mail.ru) blacklisted.
• Preserve the yclid query parameter for Yandex Metrika offline conversion uploads.

Cloaking X (Twitter Ads)

X evaluates ad cards by scraping open-graph meta tags using Twitterbot/1.0. Cloakly serves your Safe Page to Twitterbot, ensuring preview cards render compliant images and headlines, while human followers clicking the tweet in their timeline receive your Money Page.

Cloaking Native Ads (Taboola, Outbrain, MGID, Revcontent)

Native advertising networks suffer from high volumes of publisher scrapers, fraudulent click farms, and competitive spy tools.

Cloaking WebView Apps

When serving traffic inside mobile applications (e.g., in-app interstitials or rewarded video browsers), modern WebViews have unique characteristics:

• Android WebView Signature: Transmits ; wv) in the User-Agent and sends the X-Requested-With: com.app.package header.
• iOS WKWebView Signature: Emits mobile Safari signatures without certain native Safari URL-bar manipulation capabilities.
• In Cloakly Stream settings, toggle Allow Traffic From Mobile Apps to permit or quarantine in-app browser sessions according to your offer’s compatibility.

In-app Cloaking

For mobile app developers deploying landing pages inside native wrappers:

1. Dynamic Deep Links: Use Cloakly's API to verify client integrity before triggering native deep-link intents (custom-scheme:// or Universal Links).
2. Emulator Detection: Google Play Store and Apple App Store review bots run emulated Android SDK / iOS Simulator instances. Cloakly’s hardware fingerprinting flags virtualized ARM/x86 CPU signatures, presenting reviewers with a compliant in-app view.

Blacklist Bot Zones

In native and programmatic display campaigns, specific publisher domains, app IDs, or widget IDs generate purely synthetic clicks to inflate publisher revenue.

Cloakly allows you to configure URL Rules matching widget_id or zone_id parameters. Known fraudulent zones can be routed directly to the Safe Page or returned an HTTP 403 Forbidden status, preserving your affiliate payout and media budget.

Hide Traffic Source (Referrer Blanking & Spoofing)

Protect your high-performing campaigns from competitor surveillance and affiliate network sniffing:

• Blanking Referrer: Cloakly can inject <meta name="referrer" content="no-referrer"> before forwarding the user. The downstream offer page sees a clean direct visit with an empty HTTP_REFERER header.
• Referrer Spoofing: Routes the visitor through a neutral intermediary bridge domain, stripping the original ad network origin.

Basic Settings

Every stream contains key administrative properties:

• Name: Unique, descriptive title for the stream (e.g. Google Search - US Tier 1 Nutra).
• Tags: Space- or comma-separated taxonomy labels used to organize and batch-filter reporting (e.g. facebook, usa, solar, high-cpc).
• Mode: Operational state of the stream:
  • Active: Normal cloaking operation. Approved traffic goes to Money Page; bots go to Safe Page.
  • Safe Page Only: 100% of visitors (including genuine users) see the Safe Page. Recommended during initial ad review.
  • Money Page Only: All filters bypassed. Use exclusively for sandbox testing.
  • Review Mode: Aggressive protection. Any IP visiting during this mode is permanently added to the stream's blacklist.
• Notes: Free-text operator notes, change logs, and offer expiration details.
• Macros: Dynamic placeholders injected into URLs, code snippets, or postbacks:
  {click_id} {sub1} {sub2} {sub3} {sub4} {sub5} {country} {city} {ip} {isp} {os} {browser} {cost}

Money and Safe Pages

The core destination architecture splits traffic between compliant decoy assets and monetized landing pages.

Actions (21 Comprehensive Routing Behaviors)

Cloakly provides 21 granular routing actions to control exactly how the browser or server renders content for both Money and Safe pages:

Filtering Settings

Fine-tune risk evaluation sensitivity and hardware heuristic gates:

• Filtering Level:
  • Conservative: Minimum false-positive rate. Routes only confirmed datacenter ASNs to Safe Page. Best for cold account warmups.
  • Moderate (Recommended): Standard balance. Activates ASN blacklists, known crawler headers, and basic proxy detection.
  • Aggressive: Strict filtering. Rejects residential VPNs, anonymizers, suspicious subnets, and non-standard browser signatures.
  • Paranoid: Maximum security. Requires clean hardware JS fingerprinting pass; drops any unfamiliar User-Agent or out-of-geo IP immediately.
• Enable JavaScript Fingerprinting and VLA™ Model Training: Toggles client-side hardware profiling (Canvas, WebGL, AudioContext, automation hooks).
• Enable Built-in User Agent-based Filters: Blocks known crawler, spider, and scraper strings automatically.
• Allow Only Unique Visitors: Drops repeat visits from the same IP address within a configurable window (e.g. 24 hours). Prevents manual reviewer multi-click audits from inspecting your Black Page.
• Allow Only Touchscreen Devices: Restricts Black Page access to devices reporting touch hardware (maxTouchPoints > 0). Drops desktop-based emulators.
• Allow Only Visitors With In-browser Web3 Wallets: Detects window.ethereum or window.solana. Designed specifically for crypto & dApp marketing campaigns.
• Allow Traffic From Mobile Apps: Permits or blocks WebView traffic generated inside mobile apps.
• Allow Traffic From Frames, Iframes, and Embedded Objects: Blocks clicks if loaded within third-party frames (Sec-Fetch-Dest: iframe).
• Allow Google IP Protection Traffic (Chrome Privacy Sandbox): Manages emerging Google Chrome IP masking proxy pools.
• Allow Apple iCloud Private Relay Traffic: Allows or blocks Apple subscriber egress proxies (flagged as Apple Inc. ASNs).

Countries and Devices

Tracking Settings

Configure affiliate tracking parameters and cost attribution:

• Sub ID: Map incoming tracking tokens to standard slots sub1 through sub5 (e.g. sub1={placement}&sub2={creative_id}).
• Click ID: Designate the primary click identification query parameter (gclid, fbclid, ttclid, msclkid, or custom clickid).
• Click Cost: Assign a fixed Cost Per Click (CPC) or parse dynamic bid tokens (e.g. cpc={cpc}) to calculate campaign ROI in real-time reporting.

IP Address Filtering

• IP/ASN List Mode: Toggle between Blacklist (drop specified IPs/ASNs) and Whitelist (allow only specified IPs/ASNs).
• Blacklist All IP Addresses in Review Mode: When active, every single visitor IP that hits the stream while in Review Mode is automatically added to the stream’s persistent IP blacklist. Ensures ad review crawlers can never revisit your Money Page.
• IP Extrapolation: When an inspection bot IP is identified, Cloakly automatically extrapolates and blacklists the entire /24 CIDR block (all 256 surrounding IPs), neutralising bot clusters using IP rotation.

User Agent Filtering

Create granular rules targeting client User-Agent strings. Supports Contains, Exact Match, and Regular Expressions (Regex):

/(HeadlessChrome|Puppeteer|Playwright|PhantomJS|Wget|curl|Python|Scrapy)/i
/Googlebot|AdsBot-Google|facebookexternalhit|Bytespider|bingbot/i

Referrer Filtering

Inspect the HTTP_REFERER header sent by the visitor's browser:

• Referrer List Mode: Whitelist only approved traffic origins (e.g. *.google.com, *.facebook.com, *.tiktok.com).
• Blank Referrer Policy: Choose whether to permit or reject traffic lacking an HTTP Referrer (direct traffic, bookmarks, or aggressive privacy extensions).

URL Rules

Define custom conditional routing based on URL structure, query parameters, or request headers:

• Required Parameter: Only allow traffic containing a specific key (e.g. require gclid to be non-empty).
• Parameter Value Match: Direct visitors to specific landing pages based on parameter values (e.g. if utm_creative=v2, route to Money Page B).

Filtering by Time (Dayparting & Timezone Matching)

Temporal rules help evade manual inspection teams and optimize campaign spend:

PHP Integration Overview

The PHP client integration is the industry benchmark for affiliate cloaking because it executes on your web server before any HTTP response headers or HTML markup are sent to the client browser. Ad bots receive your Safe Page without ever detecting that a decision engine ran.

/public_html/ (or web root)
├── index.php    <-- Cloakly Integration File (Downloaded from Campaign Dashboard)
└── index2.php   <-- Your Compliant Safe Page (HTML or PHP)

Forward PHP Integration

In Forward Integration, Cloakly's index.php sits at the root entry point of your domain:

1. Visitor accesses https://yourdomain.com/.
2. index.php contacts the Cloakly API engine or processes local fast-cache rules.
3. If approved: Renders or forwards visitor to your Money Page.
4. If blocked: Includes index2.php in place without an HTTP redirect.

Reverse PHP Integration

In Reverse Integration, you keep your existing landing page code intact and embed the Cloakly check at the very top of your file before any output:

<?php
require_once __DIR__ . '/cloakly_client.php';
$cloak = new CloaklyClient([
    'campaign_id' => 'cmp_live_984129',
    'api_key'     => 'ck_live_a89f81bc92'
]);

$decision = $cloak->evaluate();
if (!$decision->isAllowed()) {
    // Show Safe Page and terminate execution
    include __DIR__ . '/safe_content.php';
    exit;
}
// Clean human: Continue rendering your Money Page below
?>
<!DOCTYPE html>
<html>
<head><title>Exclusive Product Offer</title></head>
...

WordPress and Other CMS Integration

To cloak a WordPress site without breaking internal admin paths:

1. Hook into wp-config.php or Theme functions.php: Ensure admin paths (/wp-admin/, /wp-login.php, /wp-json/) bypass cloaking checks.
2. Root index.php Prepend: Prepend the Cloakly client snippet before wp-blog-header.php:
   WordPress root index.php

   <?php
   if (!str_contains($_SERVER['REQUEST_URI'] ?? '', 'wp-admin')) {
       require_once __DIR__ . '/cloakly_client.php';
       // Cloakly handles routing if target campaign matches
   }
   // Native WordPress bootstrap continues
   require __DIR__ . '/wp-blog-header.php';

Getting Scan Status (Inspection Headers)

During debugging, Cloakly can be configured to emit stealth diagnostic HTTP headers:

X-Cloakly-Decision: allow | safe_page | block_403
X-Cloakly-Score: 12
X-Cloakly-Rule: GeoAllow, CleanHardware, NoBotUA
X-Cloakly-Latency-Ms: 18.4

Hidden URL Parameters (Debug Bypass)

To preview your Money Page or Safe Page directly without tripping geo or ASN filters, append your private bypass token:

• Force Money Page: https://yourdomain.com/?cloak_preview=money&key=YOUR_SECRET_KEY
• Force Safe Page: https://yourdomain.com/?cloak_preview=safe&key=YOUR_SECRET_KEY

JavaScript Integration (Static Front-ends)

For static Jamstack hosts, Webflow, Shopify, or Wix where PHP cannot run, paste the asynchronous Cloakly JS Tag in the <head>:

<script>
(function(c,l,o,a,k){
  c[o]=c[o]||function(){(c[o].q=c[o].q||[]).push(arguments)};
  a=l.createElement('script');a.async=1;a.src='https://cdn.cloakly.pro/sdk/v1/engine.js';
  a.dataset.campaign='cmp_live_984129';
  k=l.getElementsByTagName('script')[0];k.parentNode.insertBefore(a,k);
})(window,document,'Cloakly');
</script>

Switching Streams Dynamically

A single domain can route across multiple campaigns using stream selectors:

• Path-Based: Route /offer-a/ to Stream A and /offer-b/ to Stream B.
• Query-Based: Route based on ?stream=us_search or traffic source tokens.
• Header-Based: Route dynamically based on Cloudflare country headers (e.g. CF-IPCountry).

Filter Installation in Keitaro

Deploy the Cloakly evaluation hook directly into Keitaro’s internal filter directory:

1. Download the cloakly_keitaro_filter.php script from your Cloakly campaign dashboard.
2. Connect to your Keitaro server via SFTP or SSH.
3. Upload the file into the Keitaro filters directory:
   Keitaro Filters Directory Path

   /var/www/keitaro/application/filters/CloaklyFilter.php

4. Restart PHP-FPM or clear the Keitaro application cache from the admin panel (Maintenance → Clear Cache).

Campaign Setup in Keitaro

Configure your Keitaro campaign with two dedicated streams:

Binom Campaign Configuration

There are two primary methods to connect Cloakly with Binom:

<?php
require_once __DIR__ . '/cloakly.php';
if (!cloakly_verify()) {
    include __DIR__ . '/safe.html';
    exit;
}
// Serve Black LP with Binom click URL
?>

Error php-curl Extension Is Missing

Cause: Your web server’s PHP runtime lacks the cURL library required to communicate with Cloakly’s cloud scoring cluster.

Error php-json Extension Is Missing

Cause: The json_encode and json_decode functions are unavailable, preventing token payload serialization.

Error Curl Error: Couldn't Resolve Host Name

Cause: Your web server's local DNS resolver failed to resolve Cloakly's API endpoint (e.g. api.cloakly.pro).

nameserver 1.1.1.1
nameserver 8.8.8.8

404 File Not Found

Cause: The path specified for your Safe Page (e.g. index2.php) or local landing page does not exist in the designated server directory.

Layout Page Looks Broken (Missing CSS / JS / Images)

Cause: When using Reverse Proxy or local file inclusion, relative resource paths (e.g. href="style.css") break if your offer assets live on a different domain or path.

Loop Too Many Redirects (ERR_TOO_MANY_REDIRECTS)

Cause: Cloudflare SSL is set to Flexible while your server enforces HTTPS, or your Money Page URL redirects back to the cloaked entry point.

PHP Blank Page (White Screen of Death)

Cause: A fatal PHP syntax error or memory exhaustion occurred with display_errors = Off.

403 Forbidden (Error 403)

Cause: Server file permissions are too restrictive, or a server web application firewall (ModSecurity, Imunify360) is blocking the request.

JS Acquiring JS Fingerprint (MIA / Timeout)

Cause: The client browser took longer than the configured timeout (e.g. 2500ms) to submit hardware tokens, or the user is running an aggressive script blocker.

CORS JS Fingerprint Error

Cause: Cross-Origin Resource Sharing (CORS) policy blocked the client from transmitting the fingerprint payload back to the reporting endpoint.

Analytics No Clicks In Reports

Cause: Cloudflare or reverse proxy caching is serving cached HTML without executing the PHP script, or your Campaign API Key is misconfigured.

IP Clicks Tagged Cloudflare (All Visitors Share One IP)

Cause: Your web server reads $_SERVER['REMOTE_ADDR'] directly, which reflects Cloudflare’s reverse proxy IPs rather than the visitor’s actual IP.

Latency Click Count Mismatch, High Lag

Cause: Geographically distant hosting servers causing high latency during API calls, or ad networks charging for clicks where users bounced before DNS resolved.

500 Internal Server Error (Error 500)

Cause: Invalid directives in .htaccess or incompatible PHP version syntax.

Google Policy Google Ads: Compromised Site or Malicious Software

Cause: Google's automated scanners detected external scripts, unverified redirect chains, or policy-violating keywords on the domain.

Why a High-Quality Safe Page Is Mandatory

Ad network policy bots no longer accept one-page blank placeholders, "Under Construction" notices, or generic Wikipedia copy-pastes. When an ad reviewer audits your landing page, they inspect:

• Thematic Relevance: The Safe Page headline, copy, and images must closely reflect the ad creative and keywords submitted to the ad platform.
• Legal Disclosures: Working Privacy Policy, Terms of Service, and Cookie Notice links are mandatory.
• Navigational Integrity: Fully functional navigation menus, footer links, and valid internal routes.
• Clean Code Standards: Semantic HTML5, mobile-responsive CSS, fast load times, and zero external tracking scripts that raise security flags.

Step-by-Step Generator Usage

Server-to-Server (S2S) Postback

When an approved visitor completes a target action on your affiliate network or CRM (e.g. Lead, Install, Deposit, or Sale), your affiliate network sends an HTTP GET/POST request back to Cloakly’s Postback Gateway:

https://cloakly.pro/api/postback?click_id={click_id}&payout={payout}&status={status}&txid={transaction_id}

Click IDs & Deduplication

Every incoming request is assigned a unique, collision-resistant Click ID generated at the edge.

• Passing to Affiliate Network: In your Money Page URL, append click_id={click_id} or map it to your affiliate network’s subid macro (e.g. https://offer.com/?aff_sub={click_id}).
• Ad Network Token Forwarding: Cloakly seamlessly preserves native tokens (gclid, fbclid, ttclid, msclkid) and pairs them with the Cloakly Click ID, enabling dual postbacks back to Google Ads / Meta CAPI for machine-learning conversion optimization.

Sales Funnel Analytics

Cloakly aggregates raw click data into an interactive multi-stage sales funnel:

Identify conversion drop-offs, track Cost Per Acquisition (CPA), Return on Ad Spend (ROAS), and isolate which traffic sub-IDs are yielding genuine paying customers versus empty clicks.

Real-Time Click Log (Forensic Stream)

Navigate to /clicks in your dashboard to view every incoming request in microscopic forensic detail:

Domains and Hosting

• Domain History & TLDs: Always prioritize mature .com, .net, or established ccTLDs (.co.uk, .de, .us). Avoid cheap spam-prone TLDs (such as .xyz, .top, .click) which carry an automatic penalty in Google Ads trust algorithms.
• WHOIS Privacy: Ensure WHOIS privacy protection is enabled to prevent competitor intelligence scrapers from linking your advertising assets.
• Dedicated Clean IP: Never host your safe pages on cheap shared hosts containing thousands of penalized spam neighbors. Deploy on independent VPS servers (DigitalOcean, Vultr, Hetzner, AWS EC2).

Cloaking Strategy & Launch Sequence

Do Not Stand Out! (Congruency & Latency Parity)

Avoid Redirects (Zero-Redirect Supremacy)

In 2026, ad review bots flag HTTP 301/302 redirects with extreme scrutiny. Whenever an ad points to domain-a.com and immediately redirects via HTTP header to domain-b.com, Google’s automated compliance pipeline triggers a full site re-evaluation.

Always use Cloakly’s Local File action or Reverse Proxy action. The visitor remains on your approved domain while the monetized landing page is served directly.

Facebook Pixel & Conversions API (CAPI) Hygiene

Avoid firing aggressive conversion events (e.g. Purchase or Lead) on your Safe Page, as this signals unnatural conversion behavior to Meta's machine learning algorithms.

• Place standard PageView events on your Safe Page to maintain account activity.
• Fire deep funnel conversion events (InitiateCheckout, Purchase) exclusively on your Money Page and via Meta CAPI server-to-server endpoints.

Authentication

Authenticate all HTTP API requests by providing your API Key via the standard Authorization bearer header:

Authorization: Bearer ck_live_9a87d6e5c4b3a210fedcba9876543210

Collections & Endpoints Overview

Managing Streams (API Example)

Deploy a new campaign stream programmatically via cURL:

curl -X POST https://cloakly.pro/api/v1/streams \
  -H "Authorization: Bearer ck_live_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Google Ads - Solar US",
    "mode": "review",
    "real_url": "https://solar-quote.com/landing",
    "safe_url": "https://solar-editorial.com/article",
    "countries": ["US"],
    "action_type": "redirect",
    "enable_fingerprint": true
  }'

Integration PHP Files Download API

Automate your server provisioning by fetching the stream client directly via CLI:

curl -s -H "Authorization: Bearer ck_live_YOUR_TOKEN" \
  https://cloakly.pro/api/v1/streams/cmp_984129/download \
  -o /var/www/html/index.php

Guest Access to Reporting

Create shareable, read-only analytics URLs for agency clients or media buyer partners. Guest tokens restrict access strictly to designated streams and redact sensitive affiliate offer parameters.

Reporting API

Fetch click records in JSON format for ingestion into Google BigQuery, Tableau, or custom dashboards:

curl "https://cloakly.pro/api/v1/reports/clicks?stream_id=cmp_984129&decision=allow&limit=100" \
  -H "Authorization: Bearer ck_live_YOUR_TOKEN"

Account Information

Query quota limits, active plan details, and remaining monthly clicks:

{
  "plan": "Enterprise",
  "monthly_limit": 1000000,
  "clicks_used": 284102,
  "active_streams": 18,
  "status": "active"
}

IP/ASN Lists Management API

Bulk add or remove CIDR blocks and ASNs to your account-wide blacklist:

curl -X POST https://cloakly.pro/api/v1/lists/ip \
  -H "Authorization: Bearer ck_live_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "blacklist",
    "entries": ["192.0.2.0/24", "198.51.100.14"],
    "note": "Aggressive crawler cluster"
  }'