Kaspa Affiliate Systems

A private key that never touches the web server

Running an affiliate program from shared hosting sounds simple until you need to pay commissions on-chain. A private key on a web server is a liability — PHP error logs can leak environment variables, shared hosting doesn't isolate tenants at the process level, and a key that touches the filesystem is a key that's already one misconfiguration away from exposure.

This book builds a complete affiliate system that solves that problem by design: the private key lives in AWS Lambda, encrypted at rest by KMS, and the web server never sees it. Lambda holds the key and signs transactions when the web server calls it; the web server holds only a rotatable API secret for authenticating those calls.

The on-chain layer is a Solidity contract deployed on the Kasplex zkEVM Layer 2: affiliate registration, commission tracking in basis points, automatic payouts when the contract has funds, and pending accrual when it doesn't. Affiliates can withdraw their pending balance directly from the contract without the owner's involvement. Every chapter draws from real deployed code — not a tutorial scaffold but a system running in production.

The full stack, decision by decision

• The contract — AffiliatePayouts.sol: basis-points commission math, the auto-pay vs. pending-accrual logic, and the available-balance invariant that keeps payouts honest.
• Deploying to Kasplex — Hardhat config, chain ID, and gas tuning for the Kasplex zkEVM Layer 2.
• Lambda as a signing layer — KMS-encrypted key custody, IP whitelisting, an API secret instead of a key on the web server, and action routing.
• The ensure-and-sale pattern — Idempotent affiliate registration before recording a sale, closing the race condition that breaks naive implementations.
• Commission flow — Auto-pay versus pending accrual, affiliate self-withdraw, and the owner's flush operation.
• PHP integration — Calling Lambda from shared hosting, config management, and error handling that fails safely.
• Admin operations — Funding the contract, updating commission rates, and deactivating affiliates, all through Lambda actions.
• Verification — Reading on-chain state, confirming events, and building confidence before go-live.

A preview

A private key that touches the filesystem is a key that's already one misconfiguration away from exposure. The fix isn't a better secrets manager on the web server — it's removing the key from the web server entirely.

Builders running a real affiliate program on shared hosting

This book is for readers already comfortable with Solidity basics, AWS Lambda, and PHP on shared hosting who want the architectural decisions and production-specific patterns, not an introduction to any of the three. By the end you have a documented path for keeping a signing key off a web server entirely, a contract design with the invariants that keep commission math honest, and the idempotency pattern that prevents a registration race from breaking sales in production.

A longer excerpt is available to newsletter subscribers.

Buy Ebook on Amazon