Create an active operator in Provider Admin.
Public operator contract
Casino Provider Operator API
Public operator-facing contract for catalog lookup, game launch, artwork delivery, and callback wallet settlement.
- Base URL
- https://casinoproviders.net
- Auth
- x-provider-api-key
- Wallet
- Signed callbacks
Integration path
Six steps from API key to live game launch.
Assign the operator's live game catalog.
Create an operator API key.
Call catalog endpoints with x-provider-api-key.
Create launch URLs server-side and open them in the player browser.
If using callback wallet mode, expose signed balance, debit, credit, and rollback endpoints.
Start here
Operator integration flow
Operators integrate through provider API endpoints only. Runtime routes under /gs2c and /api/runtime are used by the launched game in the player browser and should not be called server-to-server.
- Use catalog APIs to read the operator-scoped game list.
- Use launch-url to create short-lived player sessions.
- Open launch_url in the player browser on desktop or mobile.
- Use callback wallet endpoints for production balance and settlement.
Authentication
Use the operator API key in request headers
The preferred header is x-provider-api-key. Bearer auth and x-api-key are accepted for compatibility. DB operator keys automatically resolve operator scope, so operators should not send another operator_id.
x-provider-api-key: ppop_operator-a_REPLACE_MEAuthorization: Bearer ppop_operator-a_REPLACE_MECatalog
Read the operator-scoped live catalog
Catalog and launch use the same allowlist. A game outside the operator catalog is hidden from catalog responses and denied on launch.
/api/provider/v1/gamesReturns the operator-scoped live catalog with feature flags, launch paths, and artwork URLs.
/api/provider/v1/games/{symbol}Returns one catalog title by symbol or slug after the same operator access checks.
curl -H "x-provider-api-key: <operator-api-key>" \
"https://casinoproviders.net/api/provider/v1/games"{
"success": true,
"data": {
"total": 1,
"operator_id": "operator-a",
"items": [
{
"symbol": "vs20doghouse",
"slug": "doghouse",
"title": "The Dog House",
"family": "line-free-spins",
"rtp": 96.51,
"lines": 20,
"asset_version": "v2",
"asset_symbol": "vs20doghouse",
"game_service_version": "v3",
"loader_mode": "generic",
"launch_status": "stable",
"live_catalog_enabled": true,
"certified_browsers": [
"chrome"
],
"features": {
"bonus": true,
"collect": true,
"free_spins": true,
"buy_feature": true,
"special_bet": false
},
"special_bet_profile": null,
"thumbnail": {
"symbol": "vs20doghouse",
"slug": "doghouse",
"title": "The Dog House",
"url": "https://casinoproviders.net/api/provider/v1/game-art/vs20doghouse?title=The+Dog+House&slug=doghouse"
},
"thumbnail_url": "https://casinoproviders.net/api/provider/v1/game-art/vs20doghouse?title=The+Dog+House&slug=doghouse",
"launch_path": "/games/doghouse"
}
]
}
}Launch
Create a short-lived browser launch URL
Create the launch URL from the operator server. Then open launch_url in the player's browser. The URL contains a short-lived session token and should not be logged publicly.
/api/provider/v1/launch-urlCreates or refreshes a player game session and returns the browser launch URL.
symbol or slugOne game identifier is required.external_player_idStable player identifier from the operator platform.coinOptional default coin value.currencyOptional ISO-style currency code; defaults to operator currency then USD.return_urlOptional lobby URL used by the game close/return flow.deviceOptional desktop, mobile, or tablet hint; tablet normalizes to mobile.curl -X POST "https://casinoproviders.net/api/provider/v1/launch-url" \
-H "content-type: application/json" \
-H "x-provider-api-key: <operator-api-key>" \
-d '{"symbol":"vs20doghouse","external_player_id":"player-129001","coin":"0.10","currency":"USD","return_url":"https://operator.example.com/lobby","device":"desktop"}'{
"success": true,
"symbol": "vs20doghouse",
"slug": "doghouse",
"operator_id": "operator-a",
"currency": "USD",
"session_id": "session-token",
"launch_url": "https://casinoproviders.net/gs2c/html5Game.do?symbol=vs20doghouse&mgckey=...",
"expires_at": "2026-06-16T16:30:00+00:00",
"data": {
"symbol": "vs20doghouse",
"slug": "doghouse",
"operator_id": "operator-a",
"currency": "USD",
"session_id": "session-token",
"launch_url": "https://casinoproviders.net/gs2c/html5Game.do?symbol=vs20doghouse&mgckey=...",
"expires_at": "2026-06-16T16:30:00+00:00"
}
}Artwork
Use catalog artwork URLs for game thumbnails
Catalog responses include thumbnail and thumbnail_url fields. The artwork endpoint is public and returns uploaded WebP, PNG, JPEG, or an SVG fallback.
/api/provider/v1/game-art/{symbol}Returns public game artwork used by catalog thumbnail URLs.
curl "https://casinoproviders.net/api/provider/v1/game-art/vs20doghouse?title=The+Dog+House&slug=doghouse"Wallet callbacks
Expose signed balance, debit, credit, and rollback endpoints
Callback wallet mode calls endpoints under the operator wallet_base_url. PP_Platform signs the exact raw JSON body with HMAC-SHA256.
{wallet_base_url}/balanceOperator-hosted callback endpoint signed with HMAC-SHA256.
{wallet_base_url}/debitOperator-hosted callback endpoint signed with HMAC-SHA256.
{wallet_base_url}/creditOperator-hosted callback endpoint signed with HMAC-SHA256.
{wallet_base_url}/rollbackOperator-hosted callback endpoint signed with HMAC-SHA256.
- Treat transaction_id as the idempotency key.
- Return the original result for duplicate successful transaction IDs.
- Fail closed on invalid signature, stale timestamp, insufficient funds, or unknown player.
- Rollback callbacks include original_transaction_id.
- If debit succeeds and a later settlement step fails, PP_Platform attempts a best-effort rollback.
content-type: application/json
x-pp-request-id: <request-id>
x-pp-timestamp: <unix-seconds>
x-pp-signature: <hex-hmac>HMAC_SHA256(wallet_secret, "{timestamp}.{raw_json_body}"){
"operator_id": "operator-a",
"player_id": "player-129001",
"session_id": "session-token",
"game_symbol": "vs20doghouse",
"currency": "USD",
"request_id": "7d8a3996269f4cf3bb9f5aa6f65de3c1",
"transaction_id": "session-token:doSpin:0:1:debit",
"transaction_type": "debit",
"action_type": "doSpin",
"amount": "2.00"
}{
"success": true,
"balance": "997.90",
"currency": "USD",
"transaction_id": "session-token:doSpin:0:1:debit"
}{
"success": false,
"error": "insufficient_funds",
"message": "Insufficient funds"
}Errors
Handle JSON errors by HTTP status
Provider API errors are returned as JSON. Operators should log request IDs and response detail fields during integration testing.
400Missing required launch field or invalid request.401Missing or invalid API key.403Inactive operator or game not enabled for this operator.404Game not found.500Production/staging environment is missing valid HTTPS GAME_BASE_URL or another server configuration is invalid.{
"success": false,
"detail": "Operator is not active"
}Production
Go-live checklist
Complete these checks before sending production traffic through a new operator integration.
- Health endpoint returns 200.
- Public GAME_BASE_URL uses HTTPS.
- Operator status is active.
- Operator catalog contains the expected games.
- Operator API key works for catalog and launch.
- Browser can open launch_url on desktop and mobile.
- Callback wallet signature verification passes.
- Balance, debit, credit, and rollback callbacks pass diagnostics.
- Operator confirms idempotency behavior for duplicate transaction_id.
- Operator confirms game close/return flow with return_url.
Downloads
Give operators the same contract in their preferred format.
These files are generated from the same canonical source as this page. Internal admin and runtime spin endpoints are intentionally excluded.