Client onboarding

From your first credentials to your first session: the API key, the IP allowlist, your wallet, the SDK install and the first call.

Get your development credentials

We create your client record on the development environment, https://aggregator-dev.asteriks.casino, with your wallet base URL, your currencies and the games you take. With it we issue your first credential: an API key and the secret you sign your requests with.

The credential is shown once, when it is issued, and we deliver it to you over a secure channel. Keep the secret in your secret store: nobody can show it again, and a lost secret means a new credential.

To rotate, ask us for a new credential. It is shown once too, and your current API key stays valid for 7 days beside it, so you can move your servers to the new one without downtime; another rotation is refused until those 7 days have passed. Your production credential is issued the same way before go-live.

The authentication page describes how your API key and your secret sign a request.

The SDK API client guide shows how the SDK takes your API key and secret and signs each request.

Send us your IP addresses

Send us the public IPv4 or IPv6 addresses, or the CIDR ranges, that your servers call the API from; a range of every address, such as 0.0.0.0/0, is refused. We put them on your allowlist.

A request from an address outside your allowlist is refused with status 401 and UNAUTHORIZED, the same answer as a wrong signature, so the answer never says which check failed. On the development environment an empty allowlist admits every address; in production it admits none.

In production the calls of the aggregator to your wallet leave from static addresses, and we send them to you, so you can admit only those on your side.

The authentication page states the allowlist rule, and the errors page lists UNAUTHORIZED.

The SDK API client guide sets up the SDK you call from those addresses.

Build your wallet

Your wallet answers the five operations the aggregator calls on your wallet base URL: balance, bet, win, rollback and round finished. The wallet webhooks page describes each one; this page does not repeat them.

Every call to your wallet is signed like your own requests, with the four headers of the authentication page. Check the signature and the timestamp, and refuse a nonce used before, before you move any money.

Answer a bet and a balance read within 3 seconds. With some providers every call is held to the same 3 seconds, so answer each call within them.

Every retry of a money operation repeats its transaction_id, so a repeat moves no money again and gets its first answer; the idempotency page has the rules. The SDK wallet kit checks the signatures and keeps these rules for you.

The SDK wallet kit guide builds this wallet on the SDK.

Before you launch a sportsbook

Do these checks before your first sportsbook launch. The Sportsbook page has the details.

  • Check the currency of each player. The aggregator opens one provider account for each player and currency, and a currency that the sportsbook cannot serve is refused with CURRENCY_NOT_SUPPORTED.
  • Send us your server IP addresses, as in the section above. Every launch is an API call, and the allowlist admits each API call only from those addresses (decision D-25).
  • Do not ask for demo mode. A sportsbook launch in demo mode is refused with DEMO_NOT_SUPPORTED.

The SDK API client guide launches a sportsbook and boots its frame with the SDK.

Install the SDK

The SDK is published to GitHub Packages under the @asteriks-aggregator scope, so your package manager reads that scope from the GitHub registry. Put these two lines in the .npmrc file beside your package.json: the first names the registry, the second reads your token from an environment variable.

.npmrc

@asteriks-aggregator:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}

GitHub Packages asks for a token even to read a package. On GitHub, open Settings, Developer settings, Personal access tokens, Tokens (classic), and generate a token with the read:packages scope only.

Set the token in the environment of the shell or the CI job that installs, then install the package with npm or Bun. The SDK needs Node.js 20 or later.

export GITHUB_PACKAGES_TOKEN=<your-token>
npm install @asteriks-aggregator/sdk
# or, with Bun
bun add @asteriks-aggregator/sdk

Never commit the token: keep it in the environment or in the secret store of your CI, never in the .npmrc file or any other file of your repository.

The SDK page lists its three entry points and their guides.

The SDK API client guide continues from the install with the SDK setup.

Make your first call

Create a session with the SDK API client: it signs the request with your credential and answers with the URL that opens the game for your player. Take a game id from the catalogue and send the request from an address on your allowlist.

first-session.ts

import { AggregatorClient } from '@asteriks-aggregator/sdk/api'

/** The URL that opens one game for a player on the development environment. */
export async function firstSession(apiKey: string, secret: string, gameId: string, playerId: string): Promise<string> {
  const client = new AggregatorClient({ baseUrl: 'https://aggregator-dev.asteriks.casino', apiKey, secret })
  const session = await client.createSession({
    player_id: playerId,
    currency: 'EUR',
    game_id: gameId,
    language: 'en',
    country: 'TR',
    device: 'desktop',
    return_url: 'https://casino.example.com/lobby',
    mode: 'real',
  })
  if (!('game_url' in session)) throw new Error('a sportsbook answers a frame, not a game_url')
  return session.game_url
}

The Create a session reference page lists every field of the request and the response, and the SDK API guide shows the rest of the calls.

Then compare your wallet with the reference operator wallet, a complete wallet built on the SDK, and run the SDK wallet test kit against your wallet. The test kit also has a self-test mode, the self-test of a deployed aggregator, which the test kit guide explains. Every case of the test kit must pass before go-live.

After go-live, the status page shows the state of the API, game launch, the provider callbacks, the catalogue sync, the wallet retries and the reports. Look at it before you ask us about a slow or failed call: an incident on the page tells you which part is affected, the effect on your players and the time of the next update.

Was this page helpful?