Wallet callbacks and HMAC verification
Verify X-Signature with HMAC-SHA256 before processing authenticate, balance, bet, win, rollback and reward callbacks.
Simulated wallet callbacks
The sandbox lets operators test callbacks against a simulated balance.
- authenticate
- balance
- bet
- win
- rollback
- reward
Verify X-Signature
X-Signature = HMAC-SHA256 of the raw request body with your webhook secret. Preserve the raw body bytes before parsing JSON; re-serializing JSON can change the signed bytes. Compare the computed digest in constant time and reject requests that fail verification before processing a callback.
The snippets take a decodeSignature function because the signature encoding is not specified here. Use the encoding supplied with your sandbox key; do not assume hex or base64. Keep your webhook secret server-side.
import { createHmac, timingSafeEqual } from 'node:crypto';
// Keep the exact raw body bytes; do not re-serialize parsed JSON.
export function verifyCallback(rawBody, signature, webhookSecret, decodeSignature) {
if (!signature || !webhookSecret) return false;
try {
// Decode X-Signature using the encoding supplied with your key.
const received = decodeSignature(signature);
if (!Buffer.isBuffer(received)) return false;
const expected = createHmac('sha256', webhookSecret).update(rawBody).digest();
return received.length === expected.length && timingSafeEqual(received, expected);
} catch {
return false;
}
}
// Pass the raw body and X-Signature before parsing or processing.
// Full field reference is included with your sandbox key.<?php
function verifyCallback(string $rawBody, string $signature,
string $webhookSecret, callable $decodeSignature): bool {
if ($signature === '' || $webhookSecret === '') return false;
try {
// Decode X-Signature using the encoding supplied with your key.
$received = $decodeSignature($signature);
if (!is_string($received)) return false;
$expected = hash_hmac('sha256', $rawBody, $webhookSecret, true);
return hash_equals($expected, $received);
} catch (Throwable $error) {
return false;
}
}
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
// Verify before parsing or processing. Keep the secret server-side.
// Full field reference is included with your sandbox key.Payload fields and errors
Full field reference is included with your sandbox key. Exact callback payload fields, error codes and rate limits are not reproduced here.