Single API to fetch all games, launch sessions, and manage player wallets. ECDSA P-256 authentication, 47 currencies, real-time WebSocket events, and 6 thumbnail sizes per game.
credoragames.com/api/lobbyECDSA P-256100 req/min3 (2 active)Desktop, Mobile, Tablet47 (fiat + crypto)Single endpoint to fetch all available games with rich metadata, thumbnails, betting markets, and integration details.
Two integration methods for launching games: URL-based (Type 1) or Server-to-Server (Type 2).
All operator-facing endpoints are secured with ECDSA P-256 digital signatures. Each request must include a cryptographic signature proving the operator identity.
Transaction endpoints called by the RGS to manage player balances. Operators implement these on their side, and the RGS calls them during gameplay.
Real-time game events delivered via WebSocket. Connect to receive live dice rolls, betting windows, and game settlements.
Standard status codes used across all API responses.
Create guest sessions for demo play, retrieve guest details, and view player transaction history.
Create game rounds, roll dice, void rolls, and manage game state. Used by the dealer panel and automated game engine.
Place bets, retrieve bet history, and view bet statistics for active games.
Manage currencies and exchange rates. Supports 47+ currencies including crypto (BTC, ETH, USDT).
Login, signup, and session management for Admin, Partner, and Dealer panels.
Partner dashboard, client management, player data, game history, financial reports, and integration info.
Dealer dashboard, active games, schedule, and profile management endpoints.
Super admin endpoints for managing partners, dealers, promotions, RBAC, and platform-wide analytics.
All operator-facing endpoints are secured using ECDSA (Elliptic Curve Digital Signature Algorithm) with the P-256 curve. This ensures mutual authentication between operators and the Credora Games RGS without sharing secrets.
/api/lobby/rgs-public-key{ method, path, operator_id, timestamp, body }X-Signature header// ECDSA Signing Example (Node.js)
const crypto = require('crypto');
function signRequest(method, path, operatorId, body, privateKeyPem) {
const timestamp = new Date().toISOString();
const payload = { method, path, operator_id: operatorId, timestamp };
if (body && Object.keys(body).length > 0) payload.body = body;
// Canonical serialization: sorted keys, no whitespace
const canonical = JSON.stringify(payload, Object.keys(payload).sort());
const sign = crypto.createSign('SHA256');
sign.update(canonical);
const signature = sign.sign(privateKeyPem, 'base64');
return { signature, timestamp };
}
// Usage:
const { signature, timestamp } = signRequest(
'POST', '/games/launch', 'your_operator_id',
{ operator_id: 'your_operator_id', user: 'player_123', ... },
privateKey
);
// Add headers to your request:
// X-Operator-Id: your_operator_id
// X-Timestamp: 2026-02-10T12:00:00.000Z
// X-Signature: MEUCIQDn...X-Operator-IdYour registered operator IDX-TimestampISO-8601 UTC timestamp (must be within 5 minutes)X-SignatureBase64-encoded ECDSA signature of canonical payloadContent-Typeapplication/json for POST requestsFull integration examples including game catalog fetch, ECDSA signing, and game launch.
const crypto = require('crypto');
const axios = require('axios');
const BASE_URL = 'https://credoragames.com/api';
const OPERATOR_ID = 'your_operator_id';
const PRIVATE_KEY = `-----BEGIN EC PRIVATE KEY-----
...your ECDSA P-256 private key...
-----END EC PRIVATE KEY-----`;
// 1. Fetch all games (no auth required)
async function getGames() {
const { data } = await axios.get(`${BASE_URL}/lobby/games`);
console.log(`Available games: ${data.total}`);
data.games.forEach(g => {
console.log(` ${g.name} (${g.game_code}) - RTP: ${g.rtp}%`);
console.log(` Thumbnails: ${Object.keys(g.thumbnails).join(', ')}`);
});
return data.games;
}
// 2. Sign a request with ECDSA
function signPayload(payload) {
const canonical = JSON.stringify(payload, Object.keys(payload).sort());
const sign = crypto.createSign('SHA256');
sign.update(canonical);
return sign.sign(PRIVATE_KEY, 'base64');
}
// 3. Launch a game (Type 2 — Server-to-Server)
async function launchGame(userId, gameCode) {
const timestamp = new Date().toISOString();
const body = {
operator_id: OPERATOR_ID,
user: userId,
token: 'player_session_token',
game_code: gameCode,
currency: 'USD',
balance: 5000,
platform: 'mobile',
lang: 'en',
lobby_url: 'https://your-casino.com/lobby'
};
const signedPayload = {
method: 'POST',
path: '/games/launch',
operator_id: OPERATOR_ID,
timestamp,
body
};
const signature = signPayload(signedPayload);
const { data } = await axios.post(`${BASE_URL}/lobby/games/launch`, body, {
headers: {
'X-Operator-Id': OPERATOR_ID,
'X-Timestamp': timestamp,
'X-Signature': signature
}
});
console.log('Game URL:', data.url);
console.log('Session:', data.session_id);
return data;
}
// 4. Embed in iframe
function getIframeHtml(gameUrl) {
return `<iframe src="${gameUrl}" width="1280" height="720"
style="border:none" allowfullscreen></iframe>`;
}
(async () => {
const games = await getGames();
const launch = await launchGame('player_123', 'snakes_ladders');
console.log('Iframe:', getIframeHtml(launch.url));
})();Contact our integration team for operator onboarding, ECDSA key exchange, and staging environment access.