Developer documentation

Integrate a game in one call

A multi-tenant game API. Your server signs a launch request; we return a URL you drop in an <iframe>. The game runs in Tunisian Dinar under an RTP you control centrally — no game code, no wallet plumbing on your side.

Quickstart

The whole integration is: sign → launch → embed. From zero to a playable game:

// 1. your credentials (from the Keys console)
$API    = 'https://vortexsoftgaming.online/api.php';
$KEY    = 'pk_xxxxxxxxxxxxxxxxxxxx';
$SECRET = 'your_api_secret';

// 2. sign the request (sorted params, HMAC-SHA256)
$p = ['api_key'=>$KEY, 'player'=>'user_42', 'game'=>'vswaysmadame'];
ksort($p);
$p['sign'] = hash_hmac('sha256', http_build_query($p), $SECRET);

// 3. launch → get the iframe URL
$ch = curl_init($API.'?action=launch');
curl_setopt_array($ch,[CURLOPT_POST=>1,CURLOPT_POSTFIELDS=>http_build_query($p),CURLOPT_RETURNTRANSFER=>1]);
$res = json_decode(curl_exec($ch), true);

// 4. embed
echo '<iframe src="'.htmlspecialchars($res['launch_url']).'" allow="autoplay; fullscreen"></iframe>';

const crypto = require('crypto');
const API='https://vortexsoftgaming.online/api.php', KEY='pk_xxx', SECRET='your_secret';

function sign(p){
  const q = Object.keys(p).sort().map(k=>`${k}=${encodeURIComponent(p[k])}`).join('&');
  return crypto.createHmac('sha256',SECRET).update(q).digest('hex');
}
const p = {api_key:KEY, player:'user_42', game:'vswaysmadame'};
p.sign = sign(p);

const r = await fetch(API+'?action=launch',{method:'POST',
  headers:{'Content-Type':'application/x-www-form-urlencoded'},
  body:new URLSearchParams(p)});
const {launch_url} = await r.json();   // → <iframe src={launch_url}>

# sign = HMAC-SHA256 of the sorted query string, keyed by your secret
SIG=$(printf 'api_key=pk_xxx&game=vswaysmadame&player=user_42' \
      | openssl dgst -sha256 -hmac "your_secret" | awk '{print $2}')

curl -s "https://vortexsoftgaming.online/api.php?action=launch" \
  --data-urlencode "api_key=pk_xxx" \
  --data-urlencode "player=user_42" \
  --data-urlencode "game=vswaysmadame" \
  --data-urlencode "sign=$SIG"
# { "ok":true, "token":"…", "launch_url":"…/play.php?s=…" }

Get your keys

Open the Keys & Domains console and generate a key for your website. You choose:

Authentication

Money and launch calls (launch, balance, deposit) must be signed. The signature proves the request came from you and wasn't tampered with. games needs only the api_key.

Signing algorithm

// worked example
params  = { api_key:"pk_abc", game:"vswaysmadame", player:"user_42" }
sorted  = "api_key=pk_abc&game=vswaysmadame&player=user_42"
sign    = hmac_sha256(sorted, api_secret)   // e.g. 9f3c1a…

IP whitelist & domain lock

Two independent guards, both set per operator in the Keys console:

API — IP whitelist

When enforcement is on, only the listed server IPs (or IPv4 CIDR ranges) may call launch/balance/deposit. A blocked call returns ip_not_whitelisted and echoes the IP it saw, so you know exactly what to add.

203.0.113.7        # a single server
10.0.0.0/24        # a whole range
# blank list = no restriction (open)

Iframe — domain lock

The game page ships a Content-Security-Policy: frame-ancestors header built from your domain, so the game can only be embedded on your site. Set the domain and no other origin can iframe your sessions.

Embedding the game

The launch_url is a normal page — put it in an iframe and give it room. It's fully responsive.

<!-- launch_url from the launch response -->
<iframe
  src="…/play.php?s=SESSION_TOKEN"
  style="width:100%;height:100vh;border:0"
  allow="autoplay; fullscreen"></iframe>

Each launch mints a fresh session bound to that one player + game. Call launch again to switch games or start a new session.

Endpoints

Start a game session for a player and get the embed URL. Creates the player wallet on first use.

Parameters

Response

{ "ok":true,
  "token":"8c9a…4ca7",
  "launch_url":"https://vortexsoftgaming.online/play.php?s=8c9a…4ca7" }

Read a player's current TND balance.

{ "ok":true, "balance":4980.50, "currency":"TND" }

Credit a player's local wallet (top-up / transfer model). Not used by seamless operators — there the balance lives on your side.

{ "ok":true, "balance":5980.50 }

List the enabled game catalog to build your lobby.

GET /api.php?action=games&api_key=pk_xxx

{ "ok":true, "games":[
  { "symbol":"vswaysmadame", "name":"Madame Destiny Megaways", "provider":"pragmatic", "category":"slots" },
  { "symbol":"vs20olympgold", "name":"Gates of Olympus Super Scatter", … }
] }

Wallet models

Pick per operator in the console. Both run the same RTP control.

Player balance & the insufficient-funds popup

Every one of your users is a player with a TND balance (solde). They play against it, not against unlimited demo credits — the platform enforces the wallet as the real spending limit on the server, on every spin.

The popup is baked into the game page — nothing to build on your side. To fund a player, credit their wallet:

Seamless wallet callback

If your wallet_mode is seamless, host an endpoint at your callback_url. We POST a signed debit/credit on every bet and win; you apply it to your wallet and return the new balance.

We send (form-urlencoded)

You return

{ "ok":true, "balance":4980.50 }   // the player's new balance, TND

RTP control

You don't set RTP per request — it's governed centrally. In the Dashboard you set a target payout ratio, volatility, bet limits and a max-win cap per operator and per game. Every booked win is scaled so the wallet's realised RTP (paid ÷ staked) tracks your target. Turn the governor off for pure pass-through. Realised RTP is shown live from the ledger.

Error codes

Errors return HTTP 200 with { "ok": false, "error": "…" }.

Go-live checklist

Live base URL https://vortexsoftgaming.online — all endpoints are relative to it.