Working on hotel and café Wi-Fi: our short setup
Three habits and one app that we use on every trip, from the lobby desk to the airport gate.
Before you join the network
Ask the front desk for the exact network name, because look-alike names are easy to set up. Use your phone's hotspot when you can, and keep your system up to date before you travel. These three steps cost nothing and take a minute.
Turn on a VPN first
A VPN app encrypts the traffic between your device and the VPN server. Other people on the same Wi-Fi see that a connection exists, not what is inside it.
ForestVPN needs no email or password. Its account number is optional, and the Free plan needs no account at all.
On your phone? Scan to open checkout.
Pick a plan
Every plan has every feature, so the choice is about how long you want to commit.
Ready?
Open checkout in a window on this page and your reader never leaves it.
Or check out right here
Prefer no window? Checkout can sit inside the page.
Your page hears these events
While checkout runs, it tells your page what happens, as events on the page. Try one of the checkouts above and watch this list. Events carry no account number, email or payment reference.
Postbacks, live
When someone you sent signs up or pays, ForestVPN calls your server. This page is that server for Acme Media. Rows leave the live log after 6 hours, and a commission stays pending until it is approved.
| Received | Event | Event ID | Click ID | Sub IDs | Amount | Commission | Rail | Method |
|---|
No postbacks in the last 6 hours. In the partner dashboard, open Postbacks and press Send test: the row appears here within a few seconds.
Set it up
- In the partner dashboard, open Postbacks and choose Add an endpoint.
- Pick the method. For GET, use this address:
https://partner-demo.forestvpn.com/pb?click_id={click_id}&sub1={sub1}&sub2={sub2}&sub3={sub3}&sub4={sub4}&sub5={sub5}&event={event}&event_id={event_id}&conversion_id={conversion_id}&amount={amount}¤cy={currency}&commission={commission}&rail={rail}&ts={ts}For POST, use this address:https://partner-demo.forestvpn.com/pb
- Keep all six events selected.
- Choose Save endpoint.
- Copy the secret. It is shown once. Then choose I have stored it.
- Press Send test.
Check every request
Anyone can call a public address, so your server checks the signature of every request before it trusts it. This is the check this page runs, in JavaScript. The guide has the same check in ten languages: postbacks guide.
const hex = (buf) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
// secret: the whole whsec_... string. signature: the X-FVPN-Signature header value.
// eventId: the X-FVPN-Event-Id header value. url: the full URL as requested (https://...).
// body: the exact bytes received (Uint8Array, from await request.arrayBuffer()). now: Unix seconds.
export async function verify(secret, signature, eventId, method, url, body, now) {
const m = /^t=([0-9]{1,15}),v1=([0-9a-f]{64})$/.exec(signature);
if (!m) return false;
const t = Number(m[1]);
if (Math.abs(now - t) > 300) return false;
const enc = new TextEncoder();
const canonical = ["v1", String(t), eventId, method, url, hex(await crypto.subtle.digest("SHA-256", body))].join("\n");
const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
const sig = Uint8Array.from(m[2].match(/../g), (h) => parseInt(h, 16));
return crypto.subtle.verify("HMAC", key, sig, enc.encode(canonical)); // constant time
}
Why your own Send test to this address gets 401
This receiver trusts only the secrets of Acme Media, and that is what the signature is for. Point your own Send test at your own server.
Set it up yourself
Links
Open Links in the partner dashboard. Choose a destination, add your tracking labels, then Copy classic link or Copy redirect-proof link.
Embeds
Open Embeds, create a key for your page, then pick Link and QR, Pricing table or Checkout on your page. Copy the code.
Postbacks
Open Postbacks, add your address, store the secret, then press Send test. Your server shows the delivery.
If your site sends a Content-Security-Policy, add this. The list of checkout hosts can change, and the documentation keeps the current one.
script-src https://fvpn.net; frame-src https://fvpn.net https://ru.fvpn.net; connect-src https://fvpn.net https://ru.fvpn.net
Building a page with an AI assistant? Give it https://fvpn.net/partners/llm.txt.