Money has to be right
A conversion, a streak bonus and a cashout all touch the same balance. If two requests can credit it at once, or a rejection does not claw the money back, the ledger drifts and never recovers.
Release 1.9.26 · Laravel 13 on PHP 8.3
A self-hosted rewards business, in full. Members earn one coin balance from offer walls, surveys, daily missions, a spin wheel, login streaks and referrals, then request a cashout that you review and pay. You get the member storefront, the admin panel, the postback plumbing and the money ledger — as source code, with no vendor between you and your own balance.
Counts are of the files and schema in the release you receive. Offer-network accounts, payout accounts and mail credentials are deliberately not included — you supply your own.
The demo is the product on a public domain with demo mode switched on, so every screen has something in it. Its landing page hands you the member credentials and opens the admin panel in one click.
The demo publishes its own member credentials on the landing page —
demo@zapcash.test / Demo@1234 — and the
administrator demo needs no password at all. The demo is a shared
environment: its balances, members and offers are not yours, and nothing
on it is a promise about earnings.
The members see coins and a spin wheel. You are running a ledger.
A conversion, a streak bonus and a cashout all touch the same balance. If two requests can credit it at once, or a rejection does not claw the money back, the ledger drifts and never recovers.
Farming is the default failure mode. Registration needs a captcha, a throttle, and enough friction that a scripted signup is not cheaper than a real member.
Each network posts conversions back with its own parameter names and its own signature scheme. Each one is a separate parser to write, and an unsigned parser is a way to mint coins from the internet.
You need a reviewed queue that holds the points until the money has actually left your account, a refund path for the requests you decline, and a decision about which accounts to pay.
Each of these is solved in the box, with the code in front of you rather than a vendor between you and your own balance.
Grouped by the job each part of the system performs. Five tabs, and every card on this page is a shipped screen.
The core loop, and the mechanics that bring a member back tomorrow. Offer walls, surveys, missions, a wheel, streaks, leaderboards and referrals — each with its own admin screen, each credit landing in the same ledger.
Every credit and debit lands in a transaction row, and the earning tracker records what caused it. The member sees their own history on the transactions page; you see every tracked action across all members in the global tracker, which is how you answer “where did this balance come from”.
Eleven networks authenticate with a secret, five by source-IP allow-list, and each provider's own scheme is implemented on top — HMAC-SHA256 with a constant-time compare on AdGem, hash-plus-IP on AdMantum. A chargeback reverses the credit the same way the credit applied it.
A callback whose secret is not configured is rejected before any parser runs — not skipped — and a replay ledger refuses the same delivery twice. A provider retrying, or a stranger posting guesses at your endpoint, cannot credit a balance twice.
The admin prints the callback URL and the parameters each connected provider needs, ready to paste into that network's dashboard — so connecting wall seven does not mean re-reading documentation you half remember.
The Torox wall pulls its inventory server-side against your member's ID, with category filtering and a single-offer lookup, so the list is live rather than a snapshot a stale browser cache is showing.
Thirteen walls ship seeded with blank credentials. Paste each network's keys in the admin and the wall URL is rebuilt with the per-member substitution in it. Surveys stay split from standard offers, so CPX Research and BitLabs get their own list.
A consecutive-day bonus that grows every day it is kept: base plus (streak − 1) × increment, defaulting to 5 coins then 2 a day. Enabled out of the box, both numbers editable in the financial settings.
Four missions ship seeded, from 25 to 1,000 coins, each claimable once and checked server-side against what the member has actually done — a completed offer or a referred friend, not a checkbox they clicked. Game, quiz, offer and refer types are defined.
Seven weighted segments seeded from 5 to 500 coins, drawn server-side against a daily spin limit (one a day by default) and written to the tracker like every other credit. The live wins feed sits underneath it.
Lifetime, daily, weekly and monthly boards computed from the earning trackers, with nine rank rewards seeded — three periods, places one to three. The prizes are paid by a scheduled command that keeps an idempotency log, so a re-run cannot pay a place twice.
One link, /r/your-name. Flat join bonuses by default;
switch on tiers and Bronze to Platinum (0, 10, 50, 200 referrals)
raise the share from 5% to 20% plus a flat bonus. Commission pays on
the referred member's join bonus and on the coins they earn from
offer wall postbacks.
A one-time credit for new accounts, disabled until you set an amount. The credit is idempotent — a tracker row marks the account, so re-seeding or a race cannot pay it twice.
Everything between a member asking for money and you paying it: methods you define, a debit that cannot double-spend, a queue with explicit states, and a refund path for every request you decline.
Four ship seeded — PayPal, Litecoin and Binance at 500 coins, Gift Card at 1,000 — as editable rows with their own minimum and required member fields. Add your own from the admin; the member's cashout page picks them up as they are.
The request runs in a row-locked transaction that re-reads the balance before it moves anything. Two clicks, two tabs or a raced postback all arrive at the same lock, so the account cannot be drawn past its balance.
Pending, approved, cancelled, returned, completed. Points are held from request to decision, and cancel or return puts them back with a tracker row. A guard makes paying that refund a second time impossible.
Each request opens with the member, method, destination and amount together, and the approve, cancel and return controls beside them. The member watches the same request move state on their transactions page.
Coin-to-dollar conversion is one admin number — 1,000 coins to the dollar, seeded — used across the dashboard figures. No live FX feed and no third-party pricing dependency: a quiet market cannot change what your screens say.
Registration is where a rewards site is won or lost, and money is where it is stolen. Two captcha providers behind one setting, a throttle on the entry points that matter, fraud heuristics on referrals, and a demo mode that sandboxes itself.
reCAPTCHA or hCaptcha, one active at a time, with the token verified server-side against the provider's endpoint — the browser is never taken at its word. Both ship off: add a key in settings to switch one on for registration and login.
Five attempts on member and on admin login, 60 requests a minute on the API, six a minute on the email-verification routes, twenty an IP on demo auto-login — each counted on the user or address the route declares, before any work is done.
Same registration IP, same device fingerprint, or a same-fingerprint IPv6 /64 block flags the account for review — each rule behind its own switch, each flag listed on the member record where you can clear it with the context in front of you.
A six-character code mailed on signup, and a middleware gate that holds member pages until it is checked — off until you turn it on. Password resets ride the same SMTP settings you configure once.
The six-step installer is session-sequenced, and step six writes a signed installation lock and clears the caches behind it. There is no install route left open after you finish.
Server-generated filenames, a detected-MIME allow-list and a decoded image check — a renamed executable is rejected by what the bytes are, not by what the extension claims to be.
With DEMO_MODE on, postbacks are refused, restricted
admin screens are refused rather than merely hidden, and outbound
mail and HTTP are sandboxed. The public demo cannot be used to
credit real balances or reach real inboxes.
The screen you will live in. Fifteen controllers, seven settings screens, a dashboard with the figures that matter, and a CRUD screen for every mechanic on the members' side.
Dashboard, users, offer walls, withdrawals, withdrawal requests, missions, wheel, leaderboard rewards, referral tiers, referrals, tracker, pages, FAQs, settings and auth — each its own controller. Single-admin by design: no role matrix to misconfigure.
Members, joins today, earnings and referrals, a 14-day signup series, sparkline trends, top earners and top referrers — with points shown in dollars at the exchange rate you configured, not at a rate someone else publishes.
General, web configuration, financial, SMTP, socials, account and
PWA — captcha keys, referral and streak money, fraud switches,
coin value, mail credentials. All editable from the panel; no
.env surgery required after install.
Missions, wheel segments, leaderboard rank rewards, referral tiers, payout methods and offer wall credentials each get their own screen — create, edit, toggle, delete — all database-driven, so next week's idea needs no deploy.
The withdrawal requests queue with approve, cancel and return — each state change moving the points for you, refunds written to the tracker — beside the payout-method list and every member's withdrawal history.
Three content pages and five FAQ rows ship seeded; edit them, add more, and toggle a question off to hide it without deleting it. Five social links come the same way, each enabled on its own.
rewards:distribute runs a day — daily, weekly on Monday
and monthly on the 1st — plus a nightly demo reset when demo mode is on.
The host needs the standard schedule:run cron entry, which the
documentation spells out with the exact line to add.
The member side is one server-rendered Blade theme — no JavaScript build, no second application to deploy — with an installable PWA manifest, two social sign-ins and a privacy toggle that actually hides the member.
Every member screen — earn, offers, missions, wheel, leaderboard, cashout, transactions, profile, invite — is Blade served by the same Laravel app. Nothing to build, nothing to keep in step with the backend, no separate hosting bill.
A real manifest and service worker served from admin-managed settings — sixteen keys for name, icons, start URL, display mode and colours — so a member can add the site to their home screen and it opens like an app.
Password auth with remember-me, the optional verification code, and Google and Facebook sign-in through Socialite — each with its own credentials, both off until you configure them.
Avatar upload, editable details, and a public-profile toggle that controls whether the member appears in the payout ticker and the leaderboard at all — consent, not a hidden setting.
A public payout ticker, a public leaderboard, the FAQ page and the content pages all render without an account, so a visitor can see the site paying people before they decide to join it.
Every step below is a real code path, and every one of them writes to the same ledger.
Captured from the release. Filter by area, then select any image to open it full size.
Names, balances and offer artwork visible in these captures are demo data from a seeded installation. Your installation starts with no members, no offers and no ledger history.
Standard Laravel and MySQL, one server-rendered theme. Nothing exotic to host.
The operator's path, then the member's.
Point a vhost at the release, make the storage directory writable, and open the site. A six-step installer checks the server, writes the environment file, runs the migrations and seeds, and creates your administrator account.
Site name, logo, favicon, meta description, social links and SMTP, all from the admin. Send yourself a test verification code to prove mail works before you invite anyone.
Open the offer walls screen, paste in your credentials for a network, and copy its printed callback URL and parameters into that network's dashboard. The wall URL is rebuilt with the member substitution as soon as you save.
Thirteen walls ship seeded with blank credentials. Toggle each one live as its keys go in — surveys keep their own list beside the standard offers — and members see them the moment they are on.
Point SMTP at a real server so verification codes send, add Google and Facebook OAuth credentials if you want social sign-in, and let members in. The captcha is there when you want it — it ships off, not on.
Add the standard schedule:run cron entry once. Daily,
weekly and monthly leaderboard rewards — and the nightly demo
reset when demo mode is on — all run from it, not from a
request.
Checked automatically by the installer, which will not continue until they pass.
| Requirement | Detail |
|---|---|
| PHP | 8.3.0 or newer |
| Extensions |
ctype, curl, dom,
fileinfo, filter, hash,
json, mbstring, openssl,
pcre, pdo, session,
tokenizer, xml — plus
zip and bcmath, which are warnings only
|
| Image processing | gd or imagick — either one satisfies the check; neither installed blocks the wizard |
| Writable paths | storage, storage/framework, bootstrap/cache, asset/uploads and the directory holding .env — all five are checked, and a failure blocks Step 2 |
| Database | MySQL / MariaDB recommended; PostgreSQL, SQLite and SQL Server also accepted. The installer tests the connection before it writes anything. |
| Web server | Anything that can serve a Laravel application, with .htaccess support if you use Apache. A web.config ships for IIS. |
| Cron | Required — one standard schedule:run entry pays the daily, weekly and monthly leaderboard rewards and runs the nightly demo reset |
| Outbound HTTPS | Required to reach offer network APIs (the live feed), captcha providers and Google / Facebook OAuth |
| SMTP is written at install and editable from the admin's SMTP screen. Verification codes and password resets need a real transport before you open registration. | |
| Node.js | Not required. The member theme is server-rendered Blade; package.json exists only for optional asset tooling. |
schedule:run cron entry that actually fires.This is the buyer documentation set, written against this release and versioned with it. It is included in the archive you receive.
Product overview, system requirements, version and support, release notes, the installation guide and the initial configuration checklist.
Eleven pages: dashboard and navigation, users and the global tracker, offer walls, missions, wheel, leaderboard rewards, referral tiers, withdrawals, pages and FAQs, settings, and the offer wall integrations.
Eight pages: account and sign-in, earning, missions, spin and win, leaderboard, cashout, referrals, profile and transactions — written for your members, so you can link them straight into your site.
Maintenance and updates, the demo mode guide, troubleshooting, the FAQ, and the third-party attributions.
Plain statements, including the parts that are limited.
You receive the complete source code and the right to run it on a server you control and modify it for your own operation.
The product is sold as a regular licence for a single installation. You cannot resell or redistribute the source as a competing product. The full terms are presented and accepted during installation, so they are recorded on your own instance as well as here.
You get an upgrade guide and a changelog, and the source is yours to maintain. The release is built from committed source rather than from a vendor's working copy, so the archive you hold matches the documented version.
Future releases are a commercial question for the vendor at the point of purchase. This page does not promise a lifetime update commitment, because none has been contracted.
HansalDev provides support on a commercial basis, and you can raise a request through the contact form before or after purchase.
This page deliberately makes no response-time or 24/7 availability promise. The shipped support page asks for your version and the exact steps that led to a problem, and points at the channel you bought through — it commits to no schedule, so none is quoted here.
Answered from what the release actually does.
A single Regular licence. No per-member fees and no revenue share to us.
One commercial licence for one installation. The full Laravel application, the member theme, the admin panel, the migrations and 30 pages of documentation.
$199.00
$
149
USD one-time
One-time payment. Taxes, if any, are added at checkout. The archive is delivered against your order, and the licence is presented and accepted again during installation so it is recorded on your own instance.
None of this is held back from you deliberately — it is not yours to resell, and some of it can only be issued to you personally.
No administrator account ships with the release: the seed contains none, and the installer creates yours with a minimum eight-character password (a command-line install generates a random one and prints it once). The seed does contain a starter set — walls with blank credentials, missions, wheel segments, payout methods, pages and FAQs — and no users, no balances and no ledger history.
You pay once for the source. There is no per-member charge, no revenue share to us, and no subscription to renew.
The licence covers one site you operate. Running several public instances is outside it, and that question is easier settled before you buy.
The source is yours to host, modify and maintain. Future releases are a commercial question with the vendor.
GPT & Rewards Platform
Launch your own GPT rewards website: offerwalls, surveys, tasks, referrals, cashouts and gamification with a full admin panel.
Offerwall & App Monetization Platform
Monetise your website or app with offerwall and content-locker integrations, postback tracking and monthly payout invoices.
Get the source code, install it, connect a network you already have an account with, and start earning from your own traffic.