> For the complete documentation index, see [llms.txt](https://scorpioplay.gitbook.io/scorpio-play-casino-api-doc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://scorpioplay.gitbook.io/scorpio-play-casino-api-doc/api-reference/images-and-media.md).

# Seamless Wallet API

On this page, you can review all Seamless Wallet API when operating in Seamless Mode.

All callback requests are sent as JSON data using the <mark style="color:green;">`POST`</mark> method.

Our API expects HTTP Status code <mark style="color:green;">`200`</mark> for all requests successful or not. All other HTTP status codes are treated as unsuccessful.

## Request Header

<table><thead><tr><th width="174">Key</th><th width="200">Value</th><th>Description</th></tr></thead><tbody><tr><td>X-Request-Signature</td><td>[Hash string]</td><td>Signature string issued by our API. For more information, please read Security section.</td></tr><tr><td>Accept</td><td>application/json</td><td>JSON data</td></tr><tr><td>Content-Type</td><td>application/json</td><td>JSON data</td></tr></tbody></table>

## Verifying Callback Request Signature

The `X-Request-Signature` header is used to ensure the authenticity and integrity of the API request. It contains a **Base64-encoded HMAC-SHA512 hash**, which the operator must generate using the request body and their secret API token (`API_TOKEN`).

1. Extract all keys and values from the request body

* The request body must be a flat JSON object (no nested objects).
* Example request body

```
{
  "amount": 1500,
  "currency": "USD",
  "playerId": "user123",
  "timestamp": 1713792000
}
```

2. Sort the keys alphabetically

* Sorted keys: `["amount", "currency", "playerId", "timestamp"]`

3. Get the corresponding values in sorted key order

* Values: `["1500", "USD", "user123", "1713792000"]`

4. Join the values with a comma(`"1500,USD,user123,1713792000"`)
5. Generate base64 encoded HMAC-SHA512 hash of the string using `API_TOKEN` as the key

```javascript
const crypto = require('crypto');

const apiToken = "my_super_secret_token";
const data = "1500,USD,user123,1713792000";

const hmac = crypto.createHmac('sha512', apiToken)
                   .update(data)
                   .digest('base64');
```

6. Compare the hash string you generated with the value provided in the `X-Request-Signature` header. If they do not match, it indicates that the request may have been altered or tampered with by a malicious actor.