Public operator contract

Golden Casino Operator API

Public operator-facing contract for catalog lookup, game launch, artwork delivery, and callback wallet settlement.

Base URL: https://goldencasino.cloud
Auth: x-provider-api-key
Wallet: Signed callbacks

POST/api/provider/v1/launch-url

Launch requestbash

curl -X POST "https://goldencasino.cloud/api/provider/v1/launch-url" \
  -H "content-type: application/json" \
  -H "x-provider-api-key: <operator-api-key>" \
  -d '{"symbol":"vs20doghouse","external_player_id":"operator-a:player-129001","coin":"0.10","currency":"USD","lang":"en","return_url":"https://operator.example.com/lobby","device":"desktop"}'

Launch responsejson

{
  "success": true,
  "symbol": "vs20doghouse",
  "slug": "doghouse",
  "operator_id": "operator-a",
  "currency": "USD",
  "lang": "en",
  "session_id": "session-token",
  "contract_version": "2026-09-01",
  "amount_unit": "minor",
  "launch_url": "https://goldencasino.cloud/gs2c/html5Game.do?symbol=vs20doghouse&lang=en&mgckey=...",
  "expires_at": "2026-06-16T16:30:00+00:00",
  "data": {
    "symbol": "vs20doghouse",
    "slug": "doghouse",
    "operator_id": "operator-a",
    "currency": "USD",
    "lang": "en",
    "session_id": "session-token",
    "contract_version": "2026-09-01",
    "amount_unit": "minor",
    "launch_url": "https://goldencasino.cloud/gs2c/html5Game.do?symbol=vs20doghouse&lang=en&mgckey=...",
    "expires_at": "2026-06-16T16:30:00+00:00"
  }
}

Integration path

Six steps from API key to live game launch.

Create an active operator in Provider Admin.

Assign the operator's live game catalog.

Create an operator API key.

Call catalog endpoints with x-provider-api-key.

Create launch URLs server-side and open them in the player browser.

If using callback wallet mode, expose signed balance, debit, credit, cancel, and rollback endpoints.

Start here

Operator integration flow

Operators integrate through provider API endpoints only. Runtime routes under /gs2c and /api/runtime are used by the launched game in the player browser and should not be called server-to-server.

Use catalog APIs to read the operator-scoped game list.
Use launch-url to create or resume sessions; expiry rules differ by provider.
Open launch_url in the player browser on desktop or mobile.
Use callback wallet endpoints for production balance and settlement.

Availability

Provider support and release limits

Lobby visibility is not proof of operator wallet support or game certification. Read the operator-scoped catalog using your own API key; never use the public demo catalog as an operator allowlist.

pragmaticPP callback-wallet transport is implemented. Only enabled, assigned games are returned. Each game's base game and advertised features still require acceptance testing.

pgNative PG callback-wallet settlement and durable round/history recovery are implemented behind PG_OPERATOR_SETTLEMENT_ENABLED. The switch is disabled by default. With it off, PG is hidden from operator-scoped catalogs and operator launches return 409. Enable it only after migration and deployed browser acceptance; pushed balance refresh remains PP-only.

playngoNative callback-wallet transport is opt-in per title through PLAYNGO_<TITLE>_OPERATOR_ENABLED. Enabled, assigned titles use HTTPS operator wallets and signed launches under https://goldencasino.cloud/playngo/<title>/. Flags default to disabled; availability also follows the release registry and operator catalog. Development sandboxes remain separate. Transport support does not replace per-title browser acceptance or authorize live funds.

spribeCrash is the lobby label, not an API provider ID. Aviator and Chicken have opt-in operator-wallet transport with signed launches at https://goldencasino.cloud/games/aviator/ and https://goldencasino.cloud/games/chicken/. The subdomain demos are temporary client demonstrations, not production operator endpoints. Production enablement and live funds remain subject to release approval and operator wallet acceptance.

operator_integrationReports mode (operator-wallet, demo-only or sandbox-only), wallet_callback and balance_refresh. Transport support is not RTP certification or production approval.

operator_availabilityReports enabled, assigned, configuration_ready, launch_available and blocker codes. Operator catalogs contain launch-available entries only; admin assignment views retain blocked entries. Without operator scope, assigned and configuration_ready are null. These are transport checks, not live-funds approval.

release_readinessReports accepted or blocked for the exact installed version from the M5B registry, with evidence and blocker reasons. Acceptance permits integrated staging and operator assignment; production still requires the remaining platform gates. Operator packages distinguish launchable_games from ready_games.

rtp and featuresRTP is stored metadata, not a verified achieved payout rate. Feature flags declare support; they do not prove the necessary replay chains exist.

Authentication

Use the operator API key in request headers

Use x-provider-api-key with a per-request HMAC-SHA256 signature in production. The signature binds the Unix timestamp, one-time nonce, HTTP method, exact path and query, and SHA-256 of the raw body. DB operator keys automatically resolve operator scope, so operators must not send another operator_id. Provider-admin service keys are separate internal credentials.

Preferred auth headerhttp

x-provider-api-key: ppop_operator-a_REPLACE_ME
x-pp-timestamp: <unix-seconds>
x-pp-nonce: <unique-16-to-128-character-value>
x-pp-signature: <hex-hmac-sha256>

Bearer alternativehttp

Authorization: Bearer ppop_operator-a_REPLACE_ME

Operator request signature payloadtext

HMAC_SHA256(operator_api_key, pp-operator-v1\n{timestamp}\n{nonce}\n{METHOD}\n{path-and-query}\n{sha256(raw_body)})

Catalog

Read the operator-scoped live catalog

Catalog and launch use the same allowlist. A game outside the operator catalog is hidden from catalog responses and denied on launch.

GET/api/provider/v1/games

Returns the operator-scoped live catalog with feature flags, launch paths, artwork URLs, and optional provider_id filtering.

GET/api/provider/v1/games/{symbol}

Returns one catalog title by symbol or slug after the same operator access checks.

List gamesbash

curl -H "x-provider-api-key: <operator-api-key>" \
  "https://goldencasino.cloud/api/provider/v1/games"

List games by providerbash

curl -H "x-provider-api-key: <operator-api-key>" \
  "https://goldencasino.cloud/api/provider/v1/games?provider_id=pragmatic"

curl -H "x-provider-api-key: <operator-api-key>" \
  "https://goldencasino.cloud/api/provider/v1/games?provider_id=pg"

Catalog responsejson

{
  "success": true,
  "data": {
    "total": 1,
    "operator_id": "operator-a",
    "items": [
      {
        "symbol": "vs20doghouse",
        "slug": "doghouse",
        "title": "The Dog House",
        "provider_id": "pragmatic",
        "provider": "Pragmatic Play",
        "family": "line-free-spins",
        "rtp": 96.51,
        "lines": 20,
        "asset_version": "v2",
        "asset_symbol": "vs20doghouse",
        "game_service_version": "v3",
        "loader_mode": "generic",
        "launch_status": "stable",
        "live_catalog_enabled": true,
        "certified_browsers": [
          "chrome"
        ],
        "features": {
          "bonus": true,
          "collect": true,
          "free_spins": true,
          "buy_feature": true,
          "special_bet": false
        },
        "special_bet_profile": null,
        "thumbnail": {
          "symbol": "vs20doghouse",
          "slug": "doghouse",
          "title": "The Dog House",
          "url": "https://goldencasino.cloud/api/provider/v1/game-art/vs20doghouse?title=The+Dog+House&slug=doghouse"
        },
        "thumbnail_url": "https://goldencasino.cloud/api/provider/v1/game-art/vs20doghouse?title=The+Dog+House&slug=doghouse",
        "launch_path": "/games/doghouse"
      }
    ]
  }
}

Launch

Create a browser launch URL

Create launch_url server-side and open it in the player's browser. Treat it as a bearer secret and do not reconstruct its query parameters. For PP and PG, expires_at is the current inactivity deadline, extended by runtime activity; it can be null. For native Play'n GO, expires_at is the 30-minute play-session deadline; the signed browser launch grant expires after five minutes. Obtain a fresh launch URL to resume an expired grant; confirmed unfinished rounds keep their original wallet route, wager and currency, and may retain an expired session deadline. Crash expires_at is its five-minute signed login grant, while PostgreSQL authorization for an authenticated session lasts one hour unless revoked. An expired launch grant is not permission to refund or debit again.

POST/api/provider/v1/launch-url

Creates or refreshes a player game session and returns the browser launch URL.

symbol or slugOne game identifier is required. If both are supplied, they must identify the same game.

external_player_idUse a stable globally unique, operator-prefixed ID of 1 to 64 characters without surrounding whitespace, such as operator-a:player-129001. PP, PG and native Play'n GO reject cross-operator reuse with 409. Crash isolates the ID by operator and currency and permits the same player ID in different operators; it preserves the supplied ID in callbacks.

coinOptional finite positive coin value for PP/PG. Native Play'n GO and Crash select actual wagers in the game; this field does not force their stake.

currencyDefaults to operator currency then USD. PP/PG and native Play'n GO accept three-letter currency codes subject to wallet/client acceptance. An unfinished slot round must resume in its original currency; changing it returns 409. Its original coin is retained for PP/PG until settlement. Aviator supports USD only. Chicken supports USD, EUR and GBP. Crash requires the operator's configured default currency; other currencies return 422.

langOptional game language code; use tr for Turkish.

return_urlOptional lobby URL. Use HTTPS without credentials or control characters. PP/PG also accept HTTP; native production requires HTTPS; Crash allows loopback HTTP for isolated testing. Verify each game's close/return flow during acceptance.

deviceOptional desktop, mobile, or tablet hint; slots normalize tablet to mobile. Crash clients use responsive browser layout.

Launch requestbash

curl -X POST "https://goldencasino.cloud/api/provider/v1/launch-url" \
  -H "content-type: application/json" \
  -H "x-provider-api-key: <operator-api-key>" \
  -d '{"symbol":"vs20doghouse","external_player_id":"operator-a:player-129001","coin":"0.10","currency":"USD","lang":"en","return_url":"https://operator.example.com/lobby","device":"desktop"}'

Launch responsejson

{
  "success": true,
  "symbol": "vs20doghouse",
  "slug": "doghouse",
  "operator_id": "operator-a",
  "currency": "USD",
  "lang": "en",
  "session_id": "session-token",
  "contract_version": "2026-09-01",
  "amount_unit": "minor",
  "launch_url": "https://goldencasino.cloud/gs2c/html5Game.do?symbol=vs20doghouse&lang=en&mgckey=...",
  "expires_at": "2026-06-16T16:30:00+00:00",
  "data": {
    "symbol": "vs20doghouse",
    "slug": "doghouse",
    "operator_id": "operator-a",
    "currency": "USD",
    "lang": "en",
    "session_id": "session-token",
    "contract_version": "2026-09-01",
    "amount_unit": "minor",
    "launch_url": "https://goldencasino.cloud/gs2c/html5Game.do?symbol=vs20doghouse&lang=en&mgckey=...",
    "expires_at": "2026-06-16T16:30:00+00:00"
  }
}

Active balance

Refresh balance inside an open game session

PP only: after a deposit or adjustment, signal active PP game pages. This endpoint does not accept a balance. Unsupported game filters return 409; unfiltered requests skip unsupported providers. sessions_notified counts signals, not acknowledged browser refreshes; inspect subscribers_notified as well.

POST/api/provider/v1/player-balance-refresh

Signals active game pages for an operator/player to refresh balance through the wallet balance callback.

external_player_idRequired stable player identifier from the operator platform.

currencyOptional three-letter currency filter.

game_symbolOptional game symbol or slug filter.

session_idOptional provider session filter.

reasonOptional reason such as deposit or manual_adjustment.

request_idOptional operator correlation id.

Balance refresh requestbash

curl -X POST "https://goldencasino.cloud/api/provider/v1/player-balance-refresh" \
  -H "content-type: application/json" \
  -H "x-provider-api-key: <operator-api-key>" \
  -d '{"external_player_id":"operator-a:player-129001","currency":"USD","reason":"deposit","request_id":"operator-request-123"}'

Balance refresh responsejson

{
  "success": true,
  "operator_id": "operator-a",
  "external_player_id": "operator-a:player-129001",
  "request_id": "operator-request-123",
  "reason": "deposit",
  "sessions_found": 1,
  "sessions_notified": 1,
  "subscribers_notified": 1,
  "sessions": [
    {
      "session_id": "session-token",
      "game_symbol": "vs20doghouse",
      "currency": "USD",
      "active_subscribers": 1,
      "notified": true
    }
  ],
  "data": {
    "operator_id": "operator-a",
    "external_player_id": "operator-a:player-129001",
    "request_id": "operator-request-123",
    "reason": "deposit",
    "sessions_found": 1,
    "sessions_notified": 1,
    "subscribers_notified": 1,
    "sessions": [
      {
        "session_id": "session-token",
        "game_symbol": "vs20doghouse",
        "currency": "USD",
        "active_subscribers": 1,
        "notified": true
      }
    ]
  }
}

Artwork

Use catalog artwork URLs for game thumbnails

Catalog responses include thumbnail and thumbnail_url fields. The artwork endpoint is public and returns uploaded WebP, PNG, JPEG, or an SVG fallback.

GET/api/provider/v1/game-art/{symbol}

Returns public game artwork used by catalog thumbnail URLs.

Fetch artworkbash

curl "https://goldencasino.cloud/api/provider/v1/game-art/vs20doghouse?title=The+Dog+House&slug=doghouse"

Wallet callbacks

Expose signed balance, debit, credit, cancel, and rollback endpoints

Callback wallet mode calls endpoints under the operator wallet_base_url. PP_Platform signs the exact raw JSON body with HMAC-SHA256.

POST{wallet_base_url}/balance