Skip to content
iGamingX
Contact

APIs and webhooks

In production

Scoped keys. Signed events.

Server-⁠to-⁠server REST with API keys that are denied by default, scoped to 19 permissions, limited by IP and expiry, and 11 outbound events signed with HMAC-⁠SHA256, retried and logged.

Talk to sales

What it does

  • Keys denied by default

    Nineteen scopes, writes on six route prefixes only, and 26 route rules that keep keys away from staff, sessions, KYC, AML, responsible gaming, privacy and support.

  • Money is never one key away

    Even a full-⁠access key cannot dispatch a withdrawal, create a refund, adjust a wallet or read personal data. Each of those needs its own scope, granted on purpose.

  • Keys with a short life

    Shown once and stored as a hash, compared in constant time, expiring after 90 days by default and 365 at most, with an optional IP allowlist.

  • Signed outbound events

    Eleven events, from sign-⁠up and KYC results to deposits, big wins, withdrawals, refunds and AML hits, each signed with HMAC-⁠SHA256 over its timestamp and body.

  • Delivery you can check

    Five attempts over about two and a half hours, an automatic pause after 20 failures in a row, a delivery log, manual redelivery and secret rotation.

  • In pilot

    Provider callbacks

    Game providers and payment gateways call their own endpoints, with signature checks, IP lists and rate limits. No provider is connected for an operator yet.

By the numbers

  • API key scopes

    19

  • Outbound events

    11

  • Delivery attempts

    5

    over about 2.5 hours

Details

How a call is authorised

A key travels in the X-API-Key header. The platform keeps only its SHA-256 and compares in constant time. Rate limits run in 21 tiers by key, user, player or IP, with X-RateLimit headers and a 429 that says when to retry.

How an event is signed

Each delivery carries X-iGX-Signature with a timestamp and an HMAC-SHA256 of the timestamp and the body, plus X-iGX-Event and X-iGX-Delivery. A redelivery names the original. Requests time out after 12 seconds, redirects are never followed, and private addresses are refused.

What is not there yet

There is no public OpenAPI file and no SDK yet: the reference lives in the console, scope by scope. The API is versioned only for affiliates, it is server to server only, and there is no separate sandbox environment yet.

Related modules

Contact

Tell us what you are building.

Markets, brands, verticals. We show you the platform with your case in mind.

Talk to sales