Casino API Documentation Guide (2026)

Every casino API doc looks intimidating on day one. This guide breaks down the 6 endpoints that matter and shows what a good spec looks like in 2026.

1. Authentication

Modern APIs use HMAC-SHA256 signed requests — an API key identifies you, a secret signs each request. Avoid vendors that still use plain bearer tokens over query strings.

2. Core endpoints

• GET /games — game catalog with thumbnails, RTP, providers.
• POST /session — get iframe launch URL for a player.
• POST /wallet/balance — return player balance (seamless mode).
• POST /wallet/bet — debit bet amount.
• POST /wallet/win — credit win amount.
• POST /wallet/rollback — reverse a bet on network failure.

3. Webhook signatures

Every incoming wallet call must be signed. Verify with:

const expected = hmac_sha256(body, secret);
if (expected !== req.headers['x-signature']) reject(401);

4. Error codes to handle

• INSUFFICIENT_FUNDS — return 402.
• DUPLICATE_TRANSACTION — idempotency guard, return original result.
• PLAYER_DISABLED — 403.
• INVALID_SIGNATURE — 401.

5. Rate limits

Expect 100-500 req/sec per operator. Wallet callbacks are NOT rate-limited — they must respond in <3s or bets fail.