API Documentation

Authentication

Gaming API uses authenticated credentials to identify applications. Your dashboard account session is used for protected developer-console actions such as creating and managing API keys.

For application-to-API requests, use an API key generated from the API Keys page. Keep the secret on your server and send it only over HTTPS.

API Keys

API keys are application credentials. The secret is generated by the backend and shown once after creation. The original secret is not stored in the database; the backend stores a one-way hash for validation.

Recommended header

Authorization: Bearer gapi_YOUR_API_KEY
Accept: application/json

Requests

Use HTTPS for all production API requests. Send JSON when an endpoint expects a request body and include the authentication header for protected endpoints.

curl -X GET "https://game-api.online/api/endpoint" \
  -H "Authorization: Bearer gapi_YOUR_API_KEY" \
  -H "Accept: application/json"

The example endpoint above is a documentation placeholder. Use the specific endpoint made available for your Gaming API account.

Server-side JavaScript example

const response = await fetch("https://game-api.online/api/endpoint", {
  headers: {
    Authorization: `Bearer ${process.env.GAMING_API_KEY}`,
    Accept: "application/json"
  }
});

const data = await response.json();

Response format

JSON responses should be handled defensively. A successful response may contain application data and a message, while errors return an appropriate HTTP status.

{
  "success": true,
  "data": {},
  "message": "Request completed"
}

Usage and limits

API access is subject to service availability, account permissions and configured rate limits. Limits may vary by API product, account and deployment environment.

When a limit is reached, clients should respect the returned 429 response and use controlled retry/backoff logic rather than repeatedly sending requests.

WebSocket / Live Game Data

The Gaming API frontend can display live round information from the real-time game service. WebSocket authentication and the final production WebSocket URL depend on the backend service that is deployed for the game engine.

Expected real-time message shape

{
  "type": "round",
  "roundId": "...",
  "status": "running",
  "multiplier": 1.42,
  "timestamp": "..."
}

Treat the example as a schema illustration only until the live backend contract is finalized.

Errors

Handle errors explicitly and never display private credentials in logs or browser error messages.

{
  "success": false,
  "error": "Invalid API key"
}

• 400 — Invalid request.
• 401 — Authentication required or API key invalid/revoked.
• 403 — Access denied.
• 404 — Resource not found.
• 429 — Rate limit exceeded.
• 500 — Server error.

Security

• Use HTTPS in production.
• Keep API secrets on your backend, never in browser code.
• Use environment variables or a dedicated secret manager.
• Rotate or revoke exposed credentials immediately.
• Do not commit API secrets to GitHub.
• Validate server responses and handle authentication failures safely.
• Use rate limiting and retry backoff where appropriate.