Failure semantics
Every mutating request uses an idempotency key. A timeout is an unknown outcome until the transaction-status endpoint resolves it; never assume failure from a lost response.
Developer platform
A small integration surface with strong boundaries.
Approved operators receive environment-scoped credentials, detailed contracts and conformance results in the partner portal. This public overview contains placeholders only.
1
Sign on your server
HMAC v2 binds key ID, method, path, query, content type, timestamp, nonce and body hash.
2
Issue a short session
POST the operator, external player reference, game, currency and optional stake to the launch endpoint.
3
Embed and observe
Load the returned one-time URL in an allowlisted iframe and process versioned lifecycle messages.
4
Settle idempotently
Implement balance, BET, WIN, refund, rollback and transaction-status behavior with safe retry semantics.
Server-side launch
Permanent secrets never enter browser code.
Generate the signature in your backend. Send only the short-lived URL to your frontend.
POST /api/v1/sessions/launch
x-okeyhan-api-key: {{sandbox_key_id}}
x-okeyhan-timestamp: 2026-08-09T12:34:56.000Z
x-okeyhan-nonce: {{unique_nonce}}
x-okeyhan-signature-version: 2
x-okeyhan-signature: {{hmac_v2}}
content-type: application/json
{
"operator_id": "{{operator_id}}",
"external_player_id": "{{opaque_player_id}}",
"game": "okey101",
"currency": "EUR"
}Environment isolation
Sandbox and production use different operator identities, credentials, allowlists, wallet endpoints and data. Sandbox credentials cannot authorize production activity.
Partner documentation
Approved teams receive complete Node.js, PHP, Python and cURL examples, error codes, webhook verification and a cutover checklist.
See the host integration in context.
Our demo shows the casino backend → launch URL → iframe boundary.