Integration Process and Environments

This page describes the steps from contract to go-live, the information the platform issues and the information the operator must provide, and the access addresses for each environment.

Process

Step	What happens	Outcome
1. Contract	Agree on the available games, currencies, operating mode (credit_mode), and fees.	Contract terms finalized
2. Provide operator information	Provide the information the operator provides listed below.	Operator registered in the test environment
3. Receive credentials	Receive the information issued by the platform through a secure channel.	Operator code, API key, API secret
4. Test environment integration	Implement the four wallet callbacks, launch games with POST /launch, connect the history API	Real gameplay in the test environment
5. Certification	The platform runs a wallet connection test (a balance call), and both sides check normal and failure scenarios together. See the Integration Checklist	Certification passed
6. Go-live	Receive new credentials for the production environment and register the production wallet URL and server IPs.	Production launch

To be agreed

The schedule, contact channels, credential delivery method, and certification scope are agreed at contract time.

Information issued by the platform

Item	Format	Used in
Operator code	Lowercase letters, digits, _, -; 2–32 characters (e.g. acme)	The X-Operator header of every request. The same value is also sent in wallet callbacks.
API key	ak_ + 40 hex characters (e.g. ak_5c0f…)	The X-Api-Key header of Operator API requests
API secret	64-character hex string	The key for bidirectional HMAC-SHA256 signing. Use it as a string, as is (do not hex-decode it). See Authentication and Signing

• The API key and API secret are delivered in plain text only once, at issuance. The platform stores the API key as a hash and the secret in encrypted form, so they cannot be shown again later. If you lose them, request reissuance.
• On reissuance, the new key and secret take effect immediately and the previous values become invalid at once. Agree on the reissuance time in advance and update the operator-side configuration at the same time.
• The test environment and production environment use different credentials.
• Keep the secret only on the operator server; never put it in a browser, app, or repository.

Information the operator provides

Item	Format	Description
Wallet callback base URL (wallet_base_url)	https:// URL, may include a path	The platform appends /balance, /debit, /credit, or /rollback to this address and sends a POST. Example: https://api.acme.example/games-wallet → https://api.acme.example/games-wallet/debit. A trailing / is ignored; do not include a query string.
Server IP allowlist (ip_allowlist)	List of IPs or CIDRs (e.g. 203.0.113.10, 198.51.100.0/28)	The public IPs of the operator servers that call the Operator API. Requests from outside the list are rejected with 403 IP_NOT_ALLOWED. Let us know in advance if you add servers or your IPs change.
Default return URL (default_return_url)	https:// URL	Used when a launch request has no return_url. The game screen's "Back to site" goes to this address, and the target origin of postMessage messages sent by the game screen is also this address's origin. See Game Launch Flow
Embed domains (embed_origins)	Scheme + host (+ port) only, no path (e.g. https://www.acme.example)	The site domains that will embed the game screen in an iframe. Only registered domains can open games in an iframe. Not needed if you only open games in a new window.
Currencies	List of currency codes (e.g. PHP, USD)	The first is the default currency. Player currencies can only be chosen from this list. Check available currencies and their decimal places with GET /currencies.
Available games	List of game codes	The games to enable. See Game Codes
Time zone	IANA name (e.g. Asia/Manila)	The display time zone for management screens. Can be changed later with PUT /settings.
Allow multiple games	Yes / No (default: No)	Whether a single player can be in multiple tables at the same time. Can be changed later with multi_table in PUT /settings.
Technical contact	—	For outages and reconciliation mismatches

Use HTTPS for the wallet URL

Wallet callbacks carry player IDs and amounts. A wallet URL that is reachable over the public internet must use HTTPS. The signature prevents tampering but does not encrypt the content.

To be agreed

The outbound IPs of the platform servers that send wallet callbacks (for the operator's firewall allowlist) are provided per environment at contract time.

Environment addresses

Actual addresses are issued per environment during onboarding and are not published in this documentation. They may change, in which case we notify you in advance. This documentation writes them as the placeholders below.

Placeholder	Meaning	Form
{API_HOST}	Operator API host	Host name only (no scheme or path)
{API_BASE}	Operator API origin	https://{API_HOST} — the Operator API base URL is {API_BASE}/operator/v1
{GAME_ORIGIN}	Game screen origin (launch_url)	https:// + host

Environment	{API_BASE}	{GAME_ORIGIN}
Test	Provided at onboarding	Provided at onboarding
Production	Provided at go-live	Provided at go-live

• The game screen origin is the origin of the launch_url returned by POST /launch. When receiving postMessage messages from the game screen, compare event.origin against this value (Game Launch Flow).
• Each environment has its own credentials and registration information (wallet URL, IP allowlist, etc.). At go-live, do not just switch the environment address — switch to the production credentials as well.
• The player browser connects directly to API and WebSocket addresses in the same family as the game screen origin. Live games use UDP to receive video, so if outbound UDP is blocked on the player's network, video may load slowly or stutter.

What the platform does during certification

• Wallet connection test: The platform sends one signed balance request to the registered wallet_base_url. If you return OK for an existing player, or PLAYER_NOT_FOUND for a nonexistent player, with HTTP 200, the address and signature verification are working. If a signature verification failure (INVALID_SIGNATURE) or an HTTP error comes back, re-check Authentication and Signing.
• Scenario checks: Together we verify normal bets and settlement, insufficient balance, rollback on wallet delays and errors, credit retries, force logout, and reconciliation (GET /transactions). For the items, see the Integration Checklist.