Player authorization

GET

player

curl --request GET \
  --url https://{host}/player \
  --header 'X-Zd-Signature: <api-key>' \
  --header 'X-Zd-Timestamp: <api-key>'

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{host}/player"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Zd-Signature", "<api-key>")
	req.Header.Add("X-Zd-Timestamp", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'GET',
  headers: {'X-Zd-Signature': '<api-key>', 'X-Zd-Timestamp': '<api-key>'}
};

fetch('https://{host}/player', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{host}/player",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-Zd-Signature: <api-key>",
    "X-Zd-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "accountId": "acct_8f2c19",
  "displayName": "Matthew S.",
  "balance": {
    "amount": 12.45,
    "currency": "USD",
    "updatedAt": "2026-01-29T14:05:29.678Z"
  },
  "subOperatorId": "9"
}

{
  "message": "missing field gameRoundId"
}

{
  "message": "invalid signature"
}

{
  "message": "internal error"
}

Authorizations

X-Zd-Signature

string

header

required

Hex-encoded HMAC-SHA512(apiPath|timestamp|data, secretKey) computed by Zero-Dash. Recompute it and compare before doing anything else. See Request signature.

X-Zd-Timestamp

string

header

required

Unix time in milliseconds, and the exact value that was signed. Reject requests older than 5 minutes.

Query Parameters

gameId

string

required

Human-readable game slug the player is opening.

Example:

"lucky-duck"

token

string

required

The session token you generated and passed to the launch URL.

Response

Player authorized.

accountId

string

required

Unique, permanent, non-personal player identifier. One account ID maps to exactly one currency. See Account ID.

displayName

string

required

Name shown to other players in the same session. Must not expose personal data.

Example:

"Matthew S."

balance

object

required

The player's balance after the operation was applied.

Show child attributes

subOperatorId

string

Optional. When several brands sit behind one integration, identify the player's brand here — the games use it to separate chat rooms and similar shared surfaces.

Example:

"9"

Player authorization

curl --request GET \
  --url https://{host}/player \
  --header 'X-Zd-Signature: <api-key>' \
  --header 'X-Zd-Timestamp: <api-key>'

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{host}/player"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Zd-Signature", "<api-key>")
	req.Header.Add("X-Zd-Timestamp", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'GET',
  headers: {'X-Zd-Signature': '<api-key>', 'X-Zd-Timestamp': '<api-key>'}
};

fetch('https://{host}/player', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{host}/player",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-Zd-Signature: <api-key>",
    "X-Zd-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "accountId": "acct_8f2c19",
  "displayName": "Matthew S.",
  "balance": {
    "amount": 12.45,
    "currency": "USD",
    "updatedAt": "2026-01-29T14:05:29.678Z"
  },
  "subOperatorId": "9"
}

{
  "message": "missing field gameRoundId"
}

{
  "message": "invalid signature"
}

{
  "message": "internal error"
}

Overview

Wallet

Troubleshooting

Player authorization

Authorizations

Query Parameters

Response