Knowledge · Integration
Casino API integration guide — HMAC, launch URL, wallet callbacks
This guide walks a backend engineer through the full AS Tech casino API integration: HMAC signing, ingesting the game catalogue, generating per-player launch URLs and implementing the four wallet callbacks. Target time: 3–5 working days to sandbox green.
Updated January 2025 · AS Tech iGaming editorial
Step 1 — Provision sandbox keys
Request access via demo access. You receive an operator_id, api_key, hmac_secret and a sandbox base URL.
Step 2 — Sign every request
Build the canonical string and sign with HMAC-SHA256:
canonical = METHOD + "\n" + PATH + "\n" + BODY + "\n" + TIMESTAMP
signature = base16(hmac_sha256(secret, canonical))
headers: X-API-Key, X-Timestamp, X-SignatureStep 3 — Ingest the game catalogue
Call GET /v1/games nightly. Cache game_id, name, provider, category, thumbnail and rtp. AS Tech notifies catalogue changes via webhook so you can refresh on demand.
Step 4 — Generate launch URLs
Per-player, call POST /v1/games/launch with the game_id, player_id, currency, lang and return_url. Render the returned URL inside an iframe (desktop) or full-screen (mobile).
Step 5 — Implement wallet callbacks
POST /balance— return{ balance: integer, currency }.POST /bet— verify signature, debit byamountif balance sufficient, storetransaction_id; return new balance.POST /win— credit byamountagainst the bet; return new balance.POST /rollback— reverse the transaction id; return new balance. Idempotent.
Step 6 — UAT and go-live
Run the AS Tech UAT suite (provided), pass the rollback stress test, complete KYC of directors, and rotate to production keys. Soft-launch with a deposit cap for 48 hours before opening fully.
Frequently asked questions
Where do I get sandbox API keys?+
Submit the demo access form and AS Tech provisions sandbox operator credentials within one business day, including an HMAC secret and base URL.
What signing algorithm is used?+
HMAC-SHA256 over a canonical string (method + path + body + timestamp), with the secret never sent over the wire. Timestamps older than 5 minutes are rejected.
Are callbacks idempotent?+
Yes. All bet/win/rollback callbacks include a unique transaction_id. Operators MUST treat the first response as authoritative and return the same result on retries.
How do I handle rollback?+
On a rollback callback, reverse the original transaction by id. If the original transaction was never recorded, return success — the player balance is the source of truth.
How is currency handled?+
All amounts are integers in the smallest unit of the operator's base currency (cents, paise, satoshis). The currency code is set per operator key.