Let say you have a Website with advertising, and each time a user clicks on it, you want to charge an advertiser the amount he bids (basically, a pay-per-click system, like Adswords, with a different cost for every click).

Now, when the user clicks on an ads, you can’t just call an API from the frontend and send the ID of the advertiser and how much he has to pay (which vary for each user), or it would be too easy for malicious user to charge an advertiser for nothing.

I was thinking about creating a token each time I show an advertisement, log that token in the database, and log it again if the user clicks on the ads. But I’m worry this might still have security flaws. Do you know what’s the best way to solve such a problem?