The three kinds of verification
Not every entry action can be checked the same way, and it's worth knowing which is which before you decide what an action is worth.
API-verified: the entrant connects their account and we ask the platform directly. X follows, Discord server membership, Spotify follows and saves, Reddit subscriptions, Tumblr follows and likes, Patreon memberships, YouTube subscriptions, Twitch follows and subs, Vimeo, Product Hunt upvotes, Disqus comments. Bluesky and Steam work from a handle with no sign-in at all.
Webhook-confirmed: the platform tells us after the fact. Twitch watch/chat/bits/hype/redeem, Kick chat and redeems, Instagram comments, tags and story mentions. These show as 'pending' on the entry page until the event arrives, then the tickets land.
Click-through: we record that they clicked and mark the entry unverified. Everything else falls here. It's still useful — it's how Gleam works for most actions too — you just shouldn't price it like a verified action.
What you need to set up
API verification only works when the site owner has registered an app with that platform and set its credentials. Until then, those actions quietly fall back to click-through and are flagged unverified rather than failing.
See docs/GOING-LIVE.md section 4 for exactly which callback URL each platform needs.
Reading the audit column
Every completion stores how it was verified. In the entrant table and the CSV export you can see which entries were confirmed by a platform and which were taken on trust, so you can weight your own judgement when something looks off.
Recurring actions
Some actions can repeat — daily check-ins, posting, sharing. Set the recurrence on the action and the limit is enforced by the database, not by a best-effort check: a daily action genuinely can't be completed twice in one UTC day, however many times someone clicks.
'Unlimited' recurrence is still capped by your plan's repeat-action limit so one person can't farm a single action forever.