Overview - Gaming API

All callback requests are sent as JSON data using the POST method. Our API expects an HTTP Status code 200 for all requests, whether successful or not. All other HTTP status codes are treated as unsuccessful.

Request Header

Key	Value	Description
`X-Request-Signature`	`Hash string`	`Signature string issued by our API.`
`Accept`	`application/json`	`Accept: application/json`
`Content-Type`	`application/json`	`Content-Type: application/json`

Verifying Callback Request Signature

The X-Request-Signatureheader is the Base64-encoded HMAC-SHA512 of the raw HTTP request body. The HMAC key is the UTF-8 bytes of API_TOKEN. Sign the body bytes exactly as they were received, before parsing JSON.

const crypto = require('crypto');

function signature(rawBody, apiToken) {
  return crypto.createHmac('sha512', apiToken)
	.update(rawBody)
	.digest('base64');
}

Compare the hash string you generated with the value provided in the X-Request-Signature header. If they do not match, it indicates that the request may have been altered or tampered with by a malicious actor.