Knowledge · Security
iGaming API security best practices
This guide covers the security controls every iGaming operator should apply when consuming or exposing casino, sportsbook and wallet APIs.
Updated January 2025 · AS Tech iGaming editorial
1. HMAC-SHA256 authentication
Every API request must be signed with HMAC-SHA256 over the canonical request (timestamp + method + path + body). Reject any request older than 5 minutes to defeat replay attacks. HMAC is preferred over OAuth for server-to-server iGaming traffic because it is stateless, faster and easier to rotate.
2. IP allowlists
Restrict production API keys to a small set of egress IPs on both sides of the integration. Rotate the allowlist whenever infrastructure changes. Never allow 0.0.0.0/0 for production keys — treat it as an incident.
3. Idempotent wallet writes
Every bet/win/rollback must carry a stable transaction_id. Deduplicate at the wallet level so retried calls after network timeouts don't double-charge players. Return the original response for any duplicate transaction_id — never a fresh transaction.
4. Rotating secrets
Rotate HMAC secrets on a fixed schedule (quarterly minimum) and immediately after any personnel change with production access. Support dual-active secrets during rotation windows so you can rotate without downtime.
5. Rate limits & circuit breakers
Every public endpoint must be rate-limited per API key. Wire circuit breakers between the wallet adapter and downstream providers so a slow provider doesn't cascade into wallet timeouts.
6. Immutable audit logs
Every wallet event and admin action must be append-only. Regulator audits require full history including who did what, when and from where. Store audit logs in a WORM (write-once-read-many) bucket with 7-year retention for most jurisdictions.
7. Encrypted KYC storage
KYC documents (ID scans, proof of address) must be encrypted at rest with per-tenant keys. Delete KYC data on player self-exclusion + regulatory retention window expiry — usually 5 years after last activity.
Frequently asked questions
Is HMAC enough on its own?+
HMAC verifies the caller has the shared secret, but you should combine it with IP allowlists and rate limits for defense in depth.
How often should we rotate secrets?+
Minimum quarterly. Rotate immediately on any incident and after any personnel change with production access.
Can I use OAuth instead of HMAC?+
You can, but HMAC is preferred for server-to-server iGaming APIs — it's stateless, cheaper and simpler to rotate at scale.
What is a WORM bucket?+
Write-Once-Read-Many storage that guarantees log entries cannot be modified or deleted before their retention window expires. Required by most gambling regulators.
Should we store the HMAC secret in code?+
Never. Use a secret manager (AWS Secrets Manager, HashiCorp Vault, Doppler) with per-environment scoping.