Environments & base URLs

Two independent sets of URLs are involved in this integration — one you point at the platform, and one the platform points at you. It's easy to mix these up since they're configured on opposite sides.

The platform's base URL (you → platform)

Your integration contact gives you the platform's base URL. Every signed call in the Operator API is ${baseUrl}${path} (e.g. https://platform.example.com/v1/operator/games/launch). No trailing slash.

If your integration contact operates more than one platform deployment (for example, a pre-production environment you test against before going live, separate from where real players play), each deployment has its own baseUrl and its own tenant ID/secret pair. Treat each as a fully separate integration — a secret issued for one deployment does not work against another. Confirm with your integration contact which baseUrl you should be pointed at for a given stage of your integration.

Registering your wallet callback URL

The platform needs to know where to send its signed wallet calls — POST /v1/wallet/transaction and GET /v1/wallet/balance — back to you. This is self-service through your tenant's portal:

• Callback base URL — set or change it yourself on the portal's Settings page (POST /portal/api/callback-url, operator role only). It must be an absolute http(s) URL. The platform starts sending signed calls to the new URL as soon as you save it — there's no separate activation step, so only point it somewhere that's already running your wallet callback implementation.
• Callback timeout — how long the platform waits for your response before treating a call as TIMED_OUT (see Wallet callback API: Timeouts). This defaults to 5000ms, seeded automatically the first time you set a callback URL. Unlike the URL itself, the timeout is not self-service — if 5000ms doesn't fit your wallet's typical response time, raise it with the platform admin team.

There's no way to query, from the portal, whether the platform has already started sending live traffic to a URL you just set — verify it yourself by triggering a DEMO-mode transaction (which doesn't touch your wallet — see Launching games) or, once you're confident, a small REAL one, and confirming your implementation received the call.

Rotating your shared secret

Also self-service through the portal's Settings page (POST /portal/api/rotate-secret) — no admin approval step. Your old secret keeps working as a fallback for a grace period after rotation (7 days by default), so both sides have time to switch over together rather than a hard cutover. See Getting your shared secret.

Clock sync

Every signed call — in either direction — is checked against a clock-skew tolerance (5 minutes by default). Keep the clock on any server that signs or verifies requests synced via NTP; a skewed clock is the most common cause of an otherwise-unexplained 401 — see Signing & authentication.