Skip to main content

Quick Start: Your First API Call

Welcome to the Evenbet Gaming API! This guide will walk you through the essential concepts and help you make your first successful API request. Our goal is to get you up and running in minutes.

Before You Begin​

This guide walks you through a simple interaction with the EvenBet API – creating a user session. Let’s make sure you have everything ready to create your first API call.

Core Concepts​

Before you dive in, let's clarify a few key terms you'll encounter throughout the documentation.

TermDescription
clientIdYour unique public identifier, included in almost every request to identify your platform.
Secret KeyA private key used exclusively on your server to generate secure request signatures. Never expose this in client-side code.
signA sha256 hash required for most API calls to ensure request integrity. The signature is generated from ALL parameters (query, path, and form/body) except for a set of excluded parameters and clientId, which must be removed before signing.
auth tokenA short-lived token required for user-specific actions, such as managing a player's balance or fetching their profile.

Getting Your Credentials​

To interact with the API, you will need a clientId and a Secret Key. To obtain your credentials for both the testing and production environments, please contact your account manager.

Security Warning

Your Secret Key grants significant access to the API. Never expose it on the client-side (in a web browser or mobile app). All requests requiring a signature must originate from a secure server environment.

Environments​

We provide environments to support both development and production. Typically, you will begin on a test or staging server provided for integration process. Once your integration is complete, you will switch to the production environment, where real users play.

Base API URL Structure

All API endpoints use the following URL structure:

https://[your_api_domain]/api/web

Note

For details on your specific setup (test, staging, or production), please consult with your EvenBet account manager.

Step 1: Generating the sign Header​

Most API endpoints require a sign header, which is a SHA256 hash that ensures request integrity.

How to Generate the Signature​

  1. Collect all request parameters (query, path, form/body). If JSON strings are present, decode them.
  {
     "userId": "1234",
     "nick": "testuser",
     "lang": "en",
     "currency": "USD",
     "authType": "external",
     "clientId": "casino123"
   }
  1. Remove clientId and the excluded keys (access-token, action, auth, channel, controller, locale, method, module, sign, version, per-page, page, sort).
   {
     "userId": "1234",
     "nick": "testuser",
     "lang": "en",
     "currency": "USD",
     "authType": "external"
   }
  1. Sort parameters alphabetically by key (recursively for nested arrays/objects).
   {
     "authType": "external",
     "currency": "USD",
     "lang": "en",
     "nick": "testuser",
     "userId": "1234"
   }
  1. Concatenate parameter values into one string.
   "externalUSDentestuser1234"
  1. Append your SECRET_KEY.
   "externalUSDentestuser1234MY_SECRET_KEY"
  1. Compute SHA256 of the result.
SHA256 ("externalUSDentestuser1234MY_SECRET_KEY") = "f3d1b1...c9a"
Interactive Testing Tool

Test the open session endpoint and observe how different values change the signature → Start Testing

Code Examples​

Here are code examples for generating the signature in multiple languages.

// This function generates the signature from an object of parameters.
const crypto = require('crypto');

function generateSignature(allParams, secretKey) {
    // Step 1: Create a copy and remove the 'clientId' parameter.
    const paramsToSign = { ...allParams };
    delete paramsToSign.clientId;

    // Step 2: Sort parameters alphabetically by key.
    const sortedKeys = Object.keys(paramsToSign).sort();

    // Step 3: Concatenate parameter values into one string.
    const concatenatedString = sortedKeys.map(key => paramsToSign[key]).join('');

    // Step 4: Append the secret key.
    const stringToHash = concatenatedString + secretKey;

    // Step 5: Compute the SHA256 hash.
    return crypto.createHash('sha256').update(stringToHash).digest('hex');
}

// --- Usage Example ---
const allParams = {
    "userId": "1234",
    "nick": "testuser",
    "authType": "external",
    "lang": "en",
    "currency": "USD",
    "clientId": "casino123"
};

const secretKey = "secretkey";

const signature = generateSignature(allParams, secretKey);

console.log(signature);
// Expected output: f3d1b113824523318546b32817349b177a456e3437533621457e8488e0b62c9a

Use this value as the sign header in your request.

info

For more information about the signature, see the Integration API Security Guide.

Step 2: Your First API Call​

Endpoint​

POST   /v2/app/users/{userId}/session?clientId={clientId}

Headers​

HeaderRequiredDescription
signYesSHA256 signature generated as described in Step 1

Request Parameters​

ParameterLocationRequiredDescription
clientIdQueryYesYour casino identifier provided by EvenBet.
userIdPath + BodyYesIdentifier of the user for whom the session is created. Must be provided in the path and as a parameter.
nickBodyNoPlayer nickname, visible to other players.
authTypeBodyNoexternal (browser) or internal (desktop/mobile app). Default: external.
langBodyNoISO two-letter code. Default: en
currencyBodyNoISO currency code (can be required if configured).

Code Examples​

// This script uses the 'axios' library for making HTTP requests.
// You can install it by running: npm install axios
const axios = require('axios');
const querystring = require('querystring');

/**
 * Main function to prepare and send the API request.
 */
async function sendRequest() {
    // --- Request Data ---
    const allParams = {
        "userId": "1234",
        "nick": "testuser",
        "authType": "external",
        "lang": "en",
        "currency": "USD",
        "clientId": "casino123"
    };

    // Note: Use the signature generated by following the steps outlined in
    // "Step 1: How to Generate the Signature".
    const signature = "f3d1b113824523318546b32817349b177a456e3437533621457e8488e0b62c9a";

    // --- Prepare and Execute the API Call ---

    // The data for the POST body must still contain userId
    const postBodyData = {
        "userId": allParams.userId,
        "nick": allParams.nick,
        "authType": allParams.authType,
        "lang": allParams.lang,
        "currency": allParams.currency,
    };
    
    const url = `https://int.pokerserversoftware.com/api/web/v2/app/users/${allParams.userId}/session?clientId=${allParams.clientId}`;
    
    const headers = {
        'content-type': 'application/x--form-urlencoded',
        'accept': 'application/vnd.api+json',
        'sign': signature,
    };

    console.log(`Using Signature: ${signature}`);
    console.log(`Request URL: ${url}`);
    console.log(`Request Body:`, postBodyData);

    // Send the request
    try {
        const response = await axios.post(url, querystring.stringify(postBodyData), { headers });
        console.log(`Response Status Code: ${response.status}`);
        console.log('Response Body:', response.data);
    } catch (error) {
        console.error(`Error Status Code: ${error.response?.status}`);
        console.error('Error Body:', error.response?.data);
    }
}

// Run the main function.
sendRequest();

Step 3: Responses​

Successful Response (200 OK)​

{
  "data": {
    "id": "FA10BD21EE1C86A4B40FAAC6308DF04A",
    "type": "session",
    "attributes": {
      "user-id": "100",
      "redirect-url": "https://your_api_domain/html5/?auth=FA10BD21EE1C86A4B40FAAC6308DF04A&lang=en",
      "auth": "FA10BD21EE1C86A4B40FAAC6308DF04A",
      "session-id": "EXT8593417090E2DB871728D7A16F882DED"
    }
  }
}

Key Response Attributes​

AttributeDescription
redirect-urlURL to open the lobby or game for the player
session-idUnique identifier of the created session
user-idID of the user the session belongs to
authShort-lived authorization token

Common Errors​

Common API Error Responses

Incorrect or missing signature validation.

Solution: Verify your signature calculation, and ensure all required parameters are included.

Example Response:

{
  "errors": [
    {
      "detail": "Not Valid Request Signature",
      "status": 400,
      "title": "Bad Request"
    }
  ]
}

What's Next?​

🎉 Congratulations, you've made your first successful API call!