> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zerodash.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Wallet Callbacks

> The five endpoints you implement and Zero-Dash calls to authorize players and move money.

One direction: **Zero-Dash → you**. Your platform is the server here. For the endpoints that run the other way, see the [Customer API](/api-reference/customer/introduction).

<Card title="You build these" icon="server" horizontal>
  `GET /player` · `POST /debit` · `POST /credit` · `POST /rollback` · `GET /players/{accountId}/transactions/{transactionId}`
</Card>

Mount them under any base path. The full path you register with Zero-Dash is the path that gets signed — a prefix such as `/zerodash/v1` is fine, as long as you verify against the same value.

<Tip>
  The playground on these pages sends **real, signed requests to whatever host you point it at**. Set the `host` server variable to your own environment and you can exercise your implementation straight from the docs.
</Tip>

## Authentication

Every inbound request carries:

```http theme={null}
X-Zd-Signature: <hex hmac-sha512>
X-Zd-Timestamp: <unix millis>
```

You must recompute the signature with your secret key and compare before doing anything else. Reject on mismatch, and reject a timestamp more than 5 minutes old.

<Warning>
  Requests must be accepted **only** from `104.248.19.126` and `46.101.149.79`. Zero-Dash takes no responsibility for malicious requests reaching your endpoints from other source addresses. See [IP allowlist](/security/ip-allowlist).
</Warning>

## Endpoints

<CardGroup cols={2}>
  <Card title="Player authorization" icon="user-check" href="/api-reference/callbacks/player">
    `GET /player` — validate the token, return identity and balance.
  </Card>

  <Card title="Debit" icon="circle-minus" href="/api-reference/callbacks/debit">
    `POST /debit` — subtract the stake when a bet is placed.
  </Card>

  <Card title="Credit" icon="circle-plus" href="/api-reference/callbacks/credit">
    `POST /credit` — add the payout and settle the bet.
  </Card>

  <Card title="Rollback" icon="rotate-left" href="/api-reference/callbacks/rollback">
    `POST /rollback` — cancel a bet and return the stake.
  </Card>

  <Card title="Get transaction" icon="magnifying-glass" href="/api-reference/callbacks/get-transaction">
    `GET /players/…/transactions/…` — report the state of one transaction.
  </Card>
</CardGroup>

## Read first

These four pages cover the rules certification actually tests. Skipping them costs more time than reading them.

<Columns cols={2}>
  <Card title="Wallet integration" icon="wallet" href="/wallet/overview" horizontal>
    The round contract, and the four rules that break integrations.
  </Card>

  <Card title="Amounts and currencies" icon="coins" href="/wallet/amounts" horizontal>
    Decimals on the wire and per-asset precision.
  </Card>

  <Card title="Idempotency" icon="fingerprint" href="/wallet/idempotency" horizontal>
    The same `transactionId` must apply exactly once.
  </Card>

  <Card title="Errors and retries" icon="triangle-exclamation" href="/wallet/errors-and-retries" horizontal>
    Why `422` and `500` are not interchangeable.
  </Card>
</Columns>

## The short version

<CardGroup cols={2}>
  <Card title="A loss still sends a credit" icon="circle-half-stroke">
    `payout.amount` of `0`. Return `200 OK`.
  </Card>

  <Card title="Settlements outlive sessions" icon="clock">
    Credit and rollback carry no token and are retried for 3 days.
  </Card>

  <Card title="Free rounds debit zero" icon="gift">
    Deduct nothing, still create the transaction.
  </Card>

  <Card title="Balance is post-movement" icon="scale-balanced">
    Return the balance after the operation, never before.
  </Card>
</CardGroup>