Casino API
Casino API for game launch and wallet integration
The Casino API is how your platform connects to Octhera's game aggregation. You call one endpoint to launch a game session, and either receive signed events for every bet, win and refund (hosted wallet) or serve one wallet endpoint that approves bets (company wallet). This page is for engineering teams scoping the work. Full request and response examples are in the documentation.
Who it's for
Backend and platform engineers
Teams who will implement game launch and the wallet side on an existing operator platform.
Technical leads scoping integration effort
Use the API summary and prerequisites below to plan the work before requesting access.
CTOs comparing aggregator APIs
See how authentication, the wallet model and signatures work before talking commercials.
What's included
Authentication
JSON over HTTPS, with your API key sent as a Bearer token. Keys are created on the portal's API keys page; an optional IP allowlist restricts where they can be used from.
Catalog: GET /games and GET /games/providers
The games and providers you can launch in your currency, with names, ids and images.
Game launch: POST /players/launch
Send your player id and the game id, plus the player's current balance on the company wallet. You get back a launch URL to open in your game frame.
Hosted wallet (API v1)
Octhera keeps player balances. You register players and fund them through the API or the portal, and receive a signed webhook for every bet, win, refund and withdrawal step. Acknowledge with any 2xx.
Company wallet (API v2)
Your wallet keeps the money. Octhera sends a signed debit for every bet, a credit for every win or refund, a rollback when a bet's outcome could not be confirmed, and a ping when you press Test wallet. Answer each with HTTP 200 and a JSON body.
Signatures
Every message from Octhera is signed with HMAC-SHA256 over the raw body using a secret from the portal, with a timestamp on the company wallet. Verify before parsing.
Integration and deployment options
Server-to-server integration
Launch requests are made from your backend with your API key. Never expose the key or a signing secret in a browser or mobile app.
Choose the wallet model
Hosted when you do not run a wallet of your own; company wallet when you already hold balances for other game providers, so each player keeps one balance.
Test before production
Use the portal's Test wallet button, then bet, win and refund flows, before moving real players.
Wallet endpoint: implementation notes
On the company wallet, the wallet endpoint is where most integration effort goes. Beyond what the documentation requires, these are the practices we recommend.
- 1
Verify against the raw body
Compute the HMAC-SHA256 over the exact bytes you received, before any JSON parsing. Re-serialised JSON may not match the signature. Reject timestamps older than a few minutes.
- 2
Compare in constant time
Use a timing-safe comparison, and answer a signature failure with an error code, not by moving money.
- 3
Store every result by type and transaction id
A rollback carries the same transaction id as the debit it reverses. Keyed by id alone, your wallet would answer the rollback with the debit's stored result and the player would lose a refused stake.
- 4
Apply amounts atomically and answer fast
Check the balance and apply the debit in one database transaction, then return the new balance. Debits must be answered within 3 seconds or the bet is refused and rolled back.
- 5
Keep the endpoint reachable
It must be a public HTTPS URL. Credits are retried for up to 72 hours until your wallet accepts them; pending ones are listed in the portal under wallet deliveries.
Onboarding steps
- 1
Get portal access
Companies receive portal credentials by email. Create an API key on the API keys page.
- 2
Configure settings
Set your lobby URL, your callback or wallet URL, and optionally the IP allowlist.
- 3
Implement game launch
Call POST /players/launch from your backend and open the returned launch URL.
- 4
Implement the wallet side
Hosted: verify and acknowledge webhooks. Company wallet: verify signatures, handle debit, credit, rollback and ping, and answer with the balance.
- 5
Test end to end
Press Test wallet, then exercise bet, win and refund flows, including duplicate deliveries and signature failures.
- 6
Go live
Move real players once your flows pass, with the providers confirmed for your markets.
What to prepare
- A backend able to make authenticated server-to-server HTTPS requests
- Access to the raw request body in your handler, for signature verification
- A public HTTPS URL for webhooks or wallet requests
- Fixed outbound IP addresses if you turn the IP allowlist on
- A wallet or ledger that can apply transactions atomically (company wallet)
Who is responsible for what
Octhera provides
- API keys, the company portal and integration support
- Game sessions and branded launch URLs
- Signed wallet traffic for every bet, win and refund, with retries for credits
- Studio-side integrations and provider settlement
The operator is responsible for
- Hold the gaming licence for each market you operate in and meet its regulatory, KYC and responsible-gambling requirements. Octhera is a B2B technology supplier and does not offer gambling to consumers.
- Keeping the API key and signing secrets server-side
- A reachable HTTPS endpoint that verifies signatures and answers wallet traffic
- Player accounts, your own transaction ledger, and balances on the company wallet
Pricing model
API access is part of every published plan: a plan price plus a percentage of gross gaming revenue, with free GGR credit to start.
Starter
Beginners / Quick Launch
$999 per month
14% of GGR · $100 GGR credit included
Scale
Growing Platforms
$2,499 one-time
12% of GGR · $500 GGR credit included
Enterprise
Scaling / Enterprise Businesses
$7,999 one-time
10% of GGR · $1,000 GGR credit included
Live figures, as published on the pricing page, which lists everything each plan includes. Prices in USD; GGR is gross gaming revenue (bets minus wins).
Frequently asked questions
Is this a seamless wallet or a transfer wallet?
Both are available. The company wallet is seamless: your platform stays the system of record and approves every bet. The hosted wallet keeps balances at Octhera, funded through the API or the portal.
How is wallet traffic secured?
Every message from Octhera is signed with HMAC-SHA256 using a secret from the portal; the company wallet adds a timestamp to the signed material. Messages go only to the HTTPS URL configured in your settings, and your API key can be limited to allowlisted IPs.
Can we test before going live?
Yes. The portal has a Test wallet button that sends a signed ping, and you can run bet, win and refund flows before moving real players.
What happens if our wallet endpoint is down?
Bets are refused in the game and rolled back; wins and refunds are retried for up to 72 hours and shown as pending in the portal. Monitor the endpoint like any payment-critical service.
Where is the full API reference?
The documentation has every endpoint and wallet message with request and response examples, including signature-verification code.
What does API access cost?
It is included in every plan: a plan price plus a share of GGR. Current figures are on the pricing page.
Talk to us about Casino API
Share your markets, platform and timeline, and we'll confirm fit, availability and next steps.
Prefer to write directly? Email sales@octhera.org or message our team on Telegram.