Overview#
All server requests in both directions are signed in the same way. Each request must be signed by the sender, and each signature must be verified by the recipient before the request body is processed.Requests to endpoints hosted on the BETCORE side (/FreeBets/..., /Freespins/..., /Game/List, /Launcher/..., etc.) are signed by the partner and verified by BETCORE. Requests to methods hosted on the partner's side (/Round/..., /Player/Balance, /Promo/..., etc.) are signed by BETCORE and must be verified by the partner.Signature generation#
In order to generate signature:1.
Take the full raw request body (raw_body) as a string, exactly as it is sent, without any transformations or normalization. The X-REQUEST-SIGN header is not included in the data to be signed.
2.
Calculate the signature using the HMAC_SHA256(raw_body, AuthToken) algorithm. The result is a 64-character (32-byte) hexadecimal string.
You can obtain the AuthToken for API v3 from your account manager.
3.
Pass the obtained value in the X-REQUEST-SIGN request header.
Signature verification#
The recipient calculates the signature from the received raw request body using the same method. The calculated signature is compared against the value of the X-REQUEST-SIGN header.The comparison is case-insensitive.
{
"code": "unauthenticated",
"msg": "Invalid request sign",
"meta": {
"api_code": "403",
"api_message": "Forbidden"
}
}
If you receive a 403 error#
If you receive an HTTP 403 error when calling BETCORE methods, ensure that:the signature is calculated based on the exact request body that was sent (byte-for-byte)
the AuthToken for API v3, obtained from your account manager, is used as the key
the signature is passed in the X-REQUEST-SIGN header in hexadecimal (hex) format.
