Launcher API

These are the endpoints we expose. Aggregators and direct integrators both call the same surface. Authentication is HTTP Basic Auth on all endpoints.

POST /gamelauncher/play

Create a session and return a launch URL.

Request

{
  "operator": "casino_abc",
  "mode": "REAL",
  "gamecode": "BINGO25",
  "currency": "EUR",
  "language": "en",
  "externalsessionid": "sess_xyz_789",
  "playerid": "player_42",
  "brand": "brand_1",
  "channel": "web",
  "country": "MT",
  "ipaddress": "203.0.113.10",
  "testaccount": false
}

mode: "DEMO" uses the same shape — currency is still required. In DEMO mode, playerid may be synthetic.

Field reference

Required

Recommended

Optional (passed through to the player session)

Response

{
  "sessionid": "<our-session-id>",
  "launchurl": "https://bingo.lpmbackstagedevelop.com/?launchCode=<code>"
}

Behaviour

• Idempotent on (operator, externalsessionid). Calling with the same pair returns the same sessionid and a fresh launchCode.
• launchCode is single-use and expires after 10 minutes by default.
• The session itself has a 24 hour absolute lifetime by default (configurable per operator). It is not refreshed by activity; expiry is fixed at creation.
• country and ipaddress are persisted on the session for audit. We don't enforce geo-rules from these fields by default — geo-rule enforcement is opt-in per operator at onboarding.
• The currency you send must be in the configured currency list for that game instance. If it isn't, /gamelauncher/play returns HTTP 400 with errorcode: 101 and message "Currency does not match instance configuration". We give you the supported list at onboarding.

About /gamelauncher/resolve-launch-code

You may notice an unauthenticated POST /gamelauncher/resolve-launch-code endpoint in network traffic from the iframe. It is an internal frontend bootstrap call: the iframe exchanges its short-lived launchCode (which is itself the credential) for a session token before the game starts. Casinos do not call this endpoint and don't need to.

POST /gamelauncher/replay

Return a URL that renders a past round for player or regulator review.

Request

Only roundid is required. Other fields are accepted-but-ignored today.

{
  "roundid": "<round-id-we-issued>"
}

Response

{
  "launchurl": "https://replay.lpmbackstagedevelop.com/?launchCode=<code>"
}

The replay frontend exchanges the embedded launchCode for a session token internally — you don't need to know about that. From your side, just embed the URL we return. Replay launch URLs are short-lived. Don't cache them. See Replay for the full flow.

Game catalogue

We don't currently expose a programmatic /gamelist endpoint. The list of games available to your operator (along with stakes, currencies, and languages) is provided in writing during onboarding and updated whenever it changes. If you need a programmatic feed for an internal admin panel, ask your account manager.

Errors

Launcher API errors use integer error codes, matching the underlying seamless-wallet provider convention:

{ "errorcode": 101, "errormessage": "bad request" }

Classify by HTTP status, not just errorcode. The two endpoints handle internal errors slightly differently: replay returns errorcode: 500 with HTTP 500; play returns errorcode: 101 with HTTP 500.

Note: this is different from the wallet-side error envelope used in direct integration, where the codes you return to us are strings (NOT_SUFFICIENT_FUNDS, etc.). Two separate surfaces, two separate code conventions.

Rate limits

We don't currently enforce a per-operator throttle on the launcher API. The only effective ceiling is the AWS API Gateway account-level default. Talk to us before sending sustained traffic above ~20 requests per second per operator so we can provision a dedicated usage plan if needed.

Versioning