AS Tech iGaming API — Developer Documentation

Every request to the AS Tech API must be signed with HMAC-SHA256 using your account's secret key. The signature is computed over the request body (or empty string for GET requests) and sent in the X-Signature header. The X-Api-Key header identifies the calling operator.

Signatures must be generated server-side — never expose your secret key in browser code. Sandbox and production use distinct keys; never reuse keys across environments.

Operators implement four webhook endpoints that AS Tech calls during game play: /balance (return current player balance), /bet (debit player wallet for a bet, return new balance), /win (credit player wallet for a win, return new balance) and /rollback (reverse a previous bet or win, return new balance).

All webhooks must be idempotent — AS Tech may retry on network failure, so duplicate calls with the same transaction_id must not double-charge. Reference implementations in Node.js, Python, Go, PHP, .NET and Java are available in the integration kit.

Errors follow a consistent shape: HTTP status code, error_code (machine-readable enum), message (human-readable) and details (context-specific object). Common codes: AUTH_INVALID, IP_NOT_WHITELISTED, RATE_LIMITED, GAME_UNAVAILABLE, INSUFFICIENT_BALANCE, PLAYER_BLOCKED.

Rate limits are 1,000 requests/second per API key by default, with burst tolerance for game launches. Higher limits are available on request. Sandbox has no rate limits to encourage thorough integration testing.

Sandbox keys are issued within 24 hours of commercial agreement. Sandbox mirrors production game logic with simulated wallets and unlimited test calls. Production rollout follows a 4-step certification: webhook idempotency tests, rollback handling, error-code coverage and load testing. Most operators complete certification in 5–10 business days.