Security Settings

Security Settings control email two-factor authentication for logins, whether advertiser postbacks must include a security token, and the network-level inbound Global Postback URL advertisers fire conversions to.

The page title is Security. Click Save Changes at the bottom after you change any toggle. This page is not Profile (your name, password, or invitation links) and not Email Settings (SMTP and templates).

Who can change Security Settings

Only a Network Admin or Super Admin should change these options. Publishers and advertisers cannot open this Settings page.

Confirm your role on the sidebar profile card if you are unsure. It should show a name and role such as OffZio Admin · Network Admin or Super Admin.

How to open Security

1. Sign in as a Network Admin or Super Admin.
2. In the left sidebar, click Settings.
3. Under Account, click Security.

Two-Factor Authentication (2FA)

The section is Two-Factor Authentication (2FA). The product states:

Note: Protect your users with two-factor authentication via email. Once enabled, then the next time your users log in, they are asked to enter the 4-digit verification code sent to their email. They only need to verify themselves every 30 days on each device.

A yellow alert reads SMTP Configuration Required:

Note: Two-Factor Authentication will only work if you have configured SMTP in the email settings.

Configure SMTP under Email Settings (Email delivery) before you rely on 2FA. This article does not invent authenticator apps, SMS, backup codes, or a forced-reset screen — those were not shown.

The three 2FA toggles

Each toggle is independent. Enabling one does not enable the others. In the screenshot all three were OFF:

1. Manager Two-Factor Authentication — Staff / manager logins.
2. Publisher Two-Factor Authentication — Affiliate logins.
3. Advertiser Two-Factor Authentication — Advertiser logins.

When a toggle is ON and SMTP is configured, that audience is asked for the 4-digit email code on the next login, then again every 30 days on each device.

Tip: Turn on Manager 2FA first so your own team proves SMTP works, then enable Publisher or Advertiser 2FA.

Advertiser Security Token for Postback

The product states:

Note: Protect your conversions tracking by adding a security token for postbacks. This Token is known to your Advertiser only and can be managed at the Advertiser Edit page.

1. Enable Security Token for Postback — Network-level toggle. Shown OFF until you turn it on.

The per-advertiser token is managed on Advertiser Edit. This article does not invent that edit form. When the token is required, advertisers must send it on postbacks so OffZio can accept the conversion.

Note: Do not paste real security tokens into chat, Internal Note, screenshots, or public docs. Treat the token like a password.

Global Postback URL

The product states:

Note: Network-level inbound URL for advertiser S2S postbacks. Base template includes click_id and sale_amount; add status, goal_type, revenue/payout, and other params from the macro list when needed.

The page also shows Allowed postback params: and a Macros Available link, then a URL field and Copy URL.

Hosts such as cpalovers.offclicker.com in examples are illustrations. Copy your live URL from this page. The hostname follows your tracking domain (see Domain Settings).

The field behaves as a generated template. Use Copy URL for the shown string. Add extra parameters from the macro list when the advertiser’s tracker needs them (status, goal_type, revenue/payout, and others). This article does not invent a custom-edit workflow beyond what the page describes.

Allowed macros

Click Macros Available to open the Tracker Postback Macros panel. Instruction text: Click a macro to copy. Use these placeholders in your URLs. Each row has a copy control, the placeholder, and a description. Click a row to copy the placeholder.

The list is scrollable.

1. {click_id} — Click ID
2. {payout} — Publisher Payout
3. {revenue} — Advertiser Revenue
4. {status} — Conversion Status
5. {goal_type} — Goal Type
6. {conversion_id} — Internal conversion row ID
7. {currency} — Conversion currency
8. {campaign_id} — Campaign ID
9. {publisher_id} — Publisher user ID
10. {sub_id_1} — Sub ID 1
11. {sub_id_2} — Sub ID 2
12. {sub_id_3} — Sub ID 3
13. {sub_id_4} — Sub ID 4
14. {sub_id_5} — Sub ID 5
15. {sub_id_6} — Sub ID 6
16. {sub_id_7} — Sub ID 7
17. {sub_id_8} — Sub ID 8
18. {sub_id_9} — Sub ID 9
19. {sub_id_10} — Sub ID 10
20. {profit} — Network profit (revenue - payout) on the conversion
21. {sale_amount} — Sale / order total stored on the conversion.
22. {sale} — Same value as Sale amount (sale_amount column)
23. {goal_alias} — Campaign goal alias stored on the conversion
24. {payment_status} — Publisher payment status (unpaid / due / paid)
25. {campaign_goal_id} — Internal campaign goal row ID
26. {conversion_unique_id} — Advertiser-supplied unique conversion id
27. {advertiser_transaction_id} — Transaction id from the advertiser
28. {transaction_id} — Same as advertiser transaction id
29. {partner_click_id} — Partner / third-party click reference
30. 
    

One screenshot listed {transaction} instead of {transaction_id}. Use whichever names appear on your live Macros Available list. This article does not decide which spelling is “correct.”

What changes when the token is ON vs OFF

1. OFF — The base template is click_id and sale_amount only. Example pattern: https://your-tracking-host/postback?click_id={click_id}&sale_amount={sale_amount}
2. ON — The same template also includes a security_token query parameter. A unique token value is appended. Advertisers must send that token on postbacks.

In help text, think of the extra piece as security_token={security_token}. Do not copy a UUID from a screenshot into production.

Give each advertiser the URL (and token, when ON) from their Advertiser Edit / postback setup, not from a help article. Accepted conversions then appear in reports such as Conversion Report.

Save Changes

Toggles and related updates are not guaranteed live until you click Save Changes (bottom right). Copy URL only copies the template currently shown.

Common tasks

Turn on email 2FA for managers

1. Configure SMTP under Email Settings and test credentials there.
2. Open Settings → Account → Security.
3. Turn Manager Two-Factor Authentication ON. Leave Publisher and Advertiser off unless you want those audiences too.
4. Click Save Changes.
5. Sign out and sign in again to confirm the 4-digit email code arrives.

Enable the advertiser security token

1. Stay on Security.
2. Turn Enable Security Token for Postback ON.
3. Click Save Changes.
4. Confirm the Global Postback URL now includes a security_token parameter.
5. On Advertiser Edit, give each advertiser their token and updated postback URL. Do not paste tokens into Internal Note.

Copy the Global Postback URL

1. Open Security and scroll to Global Postback URL.
2. Review the live host (your tracking domain) and whether security_token is present.
3. Click Copy URL.
4. Add status, goal_type, revenue/payout, or other macros from Macros Available when the advertiser’s tracker needs them.

Best practices

1. Do not enable 2FA until SMTP in Email Settings is working. The yellow alert is a hard dependency.
2. Enable Manager, Publisher, and Advertiser 2FA separately. Match each toggle to the risk of that login type.
3. Turn the security token ON before you send production postback URLs to advertisers.
4. Always copy the live Global Postback URL. Screenshot hosts are illustrations.
5. Keep tokens secret. Share them only with the advertiser who must fire the postback.
6. After you change Domain Settings (default tracking host), copy a fresh postback URL and update advertisers.