SlotBattle API
The server-to-server API your casino backend integrates against: read the game catalog, open and manage battles, and mint viewer tokens for the live feed.
Authentication
Every route on this surface takes a tenant API key as a bearer token:
Authorization: Bearer sbk_3f9a1c...
The tenant is derived from the key. There is no tenant header, and no request
body on this surface accepts a tenant field — sending one is a 400.
Each key carries its own scopes, and each route below states the one it costs.
Error envelope
Every failure on every route uses the same nested shape, including 405 and 404:
{ "error": { "code": "invalid_request", "message": "seats_total must be 2..8" } }
code is stable and safe to branch on; message is for humans and may be reworded.
Request bodies are decoded strictly
Bodies are capped at 1 MiB, reject unknown fields, and reject trailing content
after the JSON value. Sending tenant_id in a POST /battles body is a 400, not
a silently ignored override.
Money is a string
entry_amount is a canonical decimal string, never a JSON number: floats
cannot represent money exactly. Values are normalised on the way in — sending
"25.50" stores and returns "25.5", and "10.00" returns "10". Compare
amounts by parsing them as decimals, never by string equality.
Authentication
- HTTP: Bearer Auth
The tenant API key, issued from the admin console. Format: sbk_ followed by 64 hex characters. Only its SHA-256 hash is stored, and the plaintext is shown exactly once at creation. This is a server-to-server credential with casino-wide reach: it must never reach a browser — proxy calls through your own backend instead.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |