Two layers of identity
Casino API traffic has two identities: your platform (the API client) and the player (the session). Platform identity is established with API credentials; player identity is established when your platform creates a game session on the player's behalf.
API credentials
Server-to-server calls authenticate with credentials issued during onboarding — typically an API key pair or OAuth-style client credentials. Credentials must live only on your backend, never in frontend code or mobile apps.
Session tokens
When a player opens a game, your backend requests a session and receives a single-use or time-limited token. The game client uses that token, so player-facing traffic never exposes your platform credentials.
Request signing and callbacks
Wallet callbacks — bet, win, rollback — arrive at your servers from the API. Verify them: shared-secret signatures or mTLS ensure a callback genuinely comes from the API, and replay protection (unique transaction IDs, timestamps) prevents re-processing.