Friendbuy, referrals your own records approve.

Who Friendbuy is

Friendbuy describes itself as the platform for referral, loyalty and influencer programmes. The company behind it, Friendbuy, Inc., gives its address in Palos Verdes Estates, California. In a referral programme it calls the customer who shares an Advocate and the person they bring a Friend, and a campaign sets what each of them gets and which event earns it, such as a purchase, a sign-up or a custom event your own systems report. Financial services is one of the industries it lists, with a page for banks, credit unions and fintechs that ties rewards to a funded account or another qualifying event, not to a click.

Friendbuy says every account includes a REST API and webhooks. The REST API, which its documentation calls the Merchant API, creates referral links, takes sign-ups, purchases and custom events from a server, and returns or deletes what Friendbuy holds on a person. Before it hands out a reward, Friendbuy can ask your system through its Reward Validation Callback, and it reports each reward in a signed Reward Webhook. Friendbuy states that it holds SOC 2 Type II and ISO 27001, and lists Amazon Web Services in the United States as its hosting provider. A server can tell it what happened and has the last word on each reward, which is why it is one of the referral programme connectors of our Rewards & referrals module.

What it does in your platform

• Rewards & referrals

  Runs your refer-a-friend programme: it issues each customer's referral link and code, keeps the campaign's rules and reports, and counts shares, sign-ups and rewards. The platform's server tells it when a referred friend has really qualified, approves each reward through the Reward Validation Callback, and pays money rewards from the ledger.

How the connection works

Friendbuy's documentation lists no SDK for mobile apps: it says its widgets run in a web view there and app events post to the API. So nothing of Friendbuy's runs in your apps. The platform's server calls the Merchant API at mapi.fbot.me with a key and secret that never leave it, and Friendbuy answers through a callback and webhooks that carry a signature the platform checks.

1. A customer gets a link

   A customer opens the invite screen in the app and joins the programme. The platform's server calls POST /v1/personal-referral-link with the campaign's ID, the customer's email address, which Friendbuy requires, and the platform's random ID as customerId. Friendbuy returns the link and its referral code, and can add a QR code image, and the app shows them on its own screen.

2. The friend signs up with the code

   The friend opens the link or types the code when they sign up. The platform checks the code with GET /v1/referral-status, which says whether it is active and which advocate it belongs to, and keeps it with the new account. It then sends POST /v1/event/account-sign-up with the friend's email address, their platform ID and the referralCode. The sign-up shows in Friendbuy's reports and earns nothing.

3. The friend passes KYC

   The identity check runs in the KYC / AML module, and nothing about it goes to Friendbuy. The platform compares the friend with the identities it has verified and the devices it has seen, so a second account for the same person stops here, whatever email address it used.

4. A first card payment settles

   Within the 30 days your team set, the friend's first card payment settles. The platform's server sends POST /v1/event/custom with the eventType the campaign rewards, the friend's email address and platform ID, the referralCode and a deduplicationId, so the same event is never rewarded twice. No amount, card number or balance goes with it.

5. Friendbuy asks, the ledger pays

   Friendbuy applies the campaign's rules and fraud settings and, before it hands out the reward, posts the conversion to the platform's Reward Validation Callback. The platform answers 200 to approve or 400 to reject. Once approved, Friendbuy sends a Reward Webhook of type advocateReward, signed in the X-Friendbuy-Hmac-SHA256 header. The platform checks the signature and credits the advocate's balance from your marketing budget account in the ledger. A friendIncentive webhook does the same for the friend, if your campaign rewards both.

6. A refund takes it back

   If the payment is later refunded or charged back, the platform takes the credit back with a ledger entry, and your team sees both entries in the backoffice. To make that rare, the campaign can carry a Reward Delay, which keeps a reward in Pending status for the minutes, hours or days your team chooses before it is handed out.

Next to other providers

Friendbuy keeps the links, the campaign and the reports, and the platform keeps the proof. The KYC / AML and Fraud & risk modules decide whether a friend is a real new customer, the Ledger module pays and takes back money rewards, and the Backoffice shows your team each one. Where a link has to open the app or the store, one of the mobile attribution connectors of the Analytics & monitoring module, AppsFlyer, Adjust, Branch or Singular, carries the code through the install. Gift cards go out through Runa, the module's reward delivery connector, and Friendbuy can also send gift cards itself through a Tremendous account you connect to it.

Friendbuy is one of the module's referral programme connectors, next to Referral Factory and GrowSurf. The conditions for a referral, the identity and device checks, the ledger entries and the record of who referred whom all live in the platform, so moving between the three swaps a connector and leaves your apps' screens and your books as they are. The campaigns, reward tiers, fraud settings and emails are built in Friendbuy and would be built again in the new tool, and customers would be issued new links and codes there.

When Friendbuy fits best

How we get you live

• The contract

  We help you get your Friendbuy account and contract in place on its Next-Gen platform, the one its Merchant API documentation covers, together with its data processing agreement and sub-processor list, which Friendbuy provides on request. Friendbuy lists its hosting provider as Amazon Web Services in the United States and says it uses Standard Contractual Clauses for personal data leaving the EEA, the UK and Switzerland, so we go through the transfer with your privacy team before anything is signed.

• The data

  In Friendbuy's campaign builder we set the campaign to reward a Custom Event, with a reward your own systems fulfil, your Reward Validation URL, a Reward Delay and the Reward Allowance that caps how many rewards one advocate can earn. Its fraud settings and Global Reward Allowance sit under Settings, Program Integrity. The conditions a referral has to meet, the budget and the switch per country and product are set in the backoffice. Friendbuy receives an email address and the platform's random ID for each customer who joins, and the optional fields, such as names, IP address and birthday, stay empty.

• The keys

  The Merchant API key and secret come from Friendbuy's support team and go into your platform's secrets. The server exchanges them at POST /v1/authorization for a bearer token that expires after 20 minutes. The secret key that verifies the signature on every webhook and callback is kept there too, and a request without a valid signature is rejected. Your apps carry no Friendbuy key at all.

• A full test run

  Friendbuy's documentation describes no separate sandbox, so the test runs on a campaign made for it, with your team's own accounts and test email addresses and the platform in its test environment. One referral goes the whole way: the link, the sign-up, the KYC check, the first card payment, the callback, the reward webhook, the ledger credit and a refund that takes it back. Your team follows each reward's status in Friendbuy's Customer Look Up, and the test campaign is switched off before your first real customer.