API Keys & Callback URLs

Overview

Each operator has one API key that is used for:

• Authentication — the key identifies the operator in API calls
• Request signing — the secret is used to compute HMAC-SHA256 signatures

The API key and callback URLs are configured in the operator detail page.

---

Managing the API Key

Navigate to Operators → select an operator → API Keys tab.

Creating a Key

1. Click Create API Key
2. The system generates an API Secret — the HMAC signing secret (AUTH_TOKEN), shown only once!. It is prefixed with bxr_ (production) or dev_ (sandbox/local), followed by a random URL-safe token. There is no separate public key; your operator is identified by its casino_id (slug).
3. Copy the secret immediately — it will not be displayed again

Danger

The API Secret is shown only once when created or regenerated. Store it securely in your system. If you lose it, you must regenerate the key (which invalidates the old secret).

Regenerating a Key

If you need a new secret (e.g. it was compromised):

1. Click Regenerate
2. A new secret is generated — the old one is immediately invalidated
3. Copy the new secret and update your system

Caution

Regenerating invalidates the previous secret immediately. Active game sessions will continue working, but new session launches will require the new secret for signing.

Deleting a Key

Click Delete to remove the API key entirely. The operator will not be able to launch games until a new key is created.

---

Configuring Callback URLs

Navigate to Operators → select an operator → Callback URLs tab.

Enter the 4 wallet callback URLs that Beexar will call during gameplay. The Freespins finish URL, needed only if the operator issues freespins, is set by a Beexar platform administrator: your organization sees it read-only, and a change to it from your side is refused (403) — contact your account manager.

Field	Endpoint	Description
Balance URL	POST /balance	Fetch player balance
BetWin URL	POST /betwin	Debit/credit player account (atomic)
Rollback URL	POST /rollback	Reverse previous transactions
Finish URL	POST /finish	Signal round completion
Freespins finish URL	POST /freespins/finish	Optional, set by Beexar. Called once per freespins issue with its total win. Empty: the operator is not offered freespins

1. Enter each of the four round URLs in the corresponding field
2. Click Save
3. The URLs take effect immediately for new game sessions

Example Configuration

Balance URL:  https://api.casino.com/beexar/balance
BetWin URL:   https://api.casino.com/beexar/betwin
Rollback URL: https://api.casino.com/beexar/rollback
Finish URL:   https://api.casino.com/beexar/finish
Freespins finish URL (optional): https://api.casino.com/beexar/freespins/finish

Requirements

Requirement	Details
Protocol	HTTPS required
Availability	Must be publicly accessible from Beexar servers
No redirects	Answer at the configured URL itself: Beexar does not follow redirects, and a 3xx answer counts as a failed call
Response time	Should respond within 10 seconds

Note

Changes to callback URLs take effect for new sessions only. Sessions that are already active will continue using the URLs that were configured when the session was created.

---

Using the API Secret

In Launch Requests

The API secret signs the request body; the resulting HMAC goes in the X-REQUEST-SIGN header:

BODY='{"casino_id":"your-slug","game":"dice","account":{"id":"player_1","currency":"USD"}}'
SECRET="your_api_secret"
SIGNATURE=$(echo -n "$BODY" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl -X POST https://gateway.beexar.com/api/v1/softswiss/launcher/real \
  -H "Content-Type: application/json" \
  -H "X-REQUEST-SIGN: $SIGNATURE" \
  -d "$BODY"

In Wallet Callbacks

Beexar signs every wallet request with the same secret. Your server must validate the X-REQUEST-SIGN header:

const crypto = require('crypto');

function validateSignature(body, signature, secret) {
  const expected = crypto.createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

See Authentication for code samples in Go, Python, PHP, and more.