Admin console
The operations console is where humans do what the API does not let a backend do: onboard casinos, issue credentials, change per-casino configuration, and review what happened.
It is a second authentication surface alongside the S2S API, and the two share no code, so that adding authentication to a new route cannot pick the wrong one by proximity.
| S2S API | Admin console | |
|---|---|---|
| Credential | Authorization: Bearer sbk_… | HttpOnly session cookie |
| Caller | Your casino backend | An operator's browser |
| Tenant | Derived from the key | X-Tenant-Id header |
| Authorisation | Key scopes (battles:write) | Role permissions (battles.write) |
Note the punctuation: API key scopes use a colon, console permissions use a dot. They are
different vocabularies for different actors, and mixing them up produces a 403 that reads
like a bug.
What the console can and cannot do
Can: create casinos, issue and revoke API keys, edit per-casino credentials and webhooks, manage members and roles, allow and revoke games, rotate the viewer signing key, tune lobby windows, read battles, and cancel an open lobby.
Cannot: open a battle. That is the consuming backend's act over S2S. It carries a player reference, a wallet and a settlement, none of which exist in an operator's session. The console's battle surface is read-only plus one cancel.
Two rules that run through everything
Scope first, always. Authenticate, resolve X-Tenant-Id, then load the role's
permissions. Checking a permission before membership would tell someone with no link to the
casino that the permission exists.
A failed read of the access catalog denies. Treating an unreadable table as "allow" would turn a database fault into an open console with no symptom.
Getting in
There is no registration route. Your first operator account is created for you by the platform when they onboard your casino, and after that operators add each other from the console.
If you have no console account yet, that is one of the handover items. See What you receive.
Sections
| Authentication | Sessions, TOTP, magic links, and the domain constraint |
| Users, casinos and roles | Membership and the permission model |
| API keys | Issuing the S2S credential |
| Settings | Per-casino credentials and lobby windows |
| Signing keys | Rotating the viewer keyring |
| Battles and games | Read-only operations and the allowlist |
| Reference | Every route, with Try It |