> ## Documentation Index > Fetch the complete documentation index at: https://docs.zerodash.studio/llms.txt > Use this file to discover all available pages before exploring further. # Player authorization > Called once when a player opens a game. Validate the launch `token`, then return the player's identity and current balance. Reject the request if the token is unknown, expired or belongs to a different player — the game will refuse to start. The `accountId` you return here is the identity Zero-Dash uses for every bet, transaction, report and audit for the lifetime of that player. See [Account ID](/wallet/account-id). ## OpenAPI ````yaml api-reference/callbacks.json GET /player openapi: 3.1.0 info: title: Zero-Dash Wallet Callbacks version: 1.0.0 summary: >- The wallet API that you implement and Zero-Dash calls to authorize players and move money. description: >- **You implement these five endpoints. Zero-Dash calls them.** This is the inverse direction of the [Customer API](/api-reference/customer/list-games): here Zero-Dash is the client and your platform is the server. Mount them under any base path you like — the full path you register is what gets signed. All endpoints must be RESTful, accept and return JSON, and be served over HTTPS with a valid TLS certificate. Before you write a line of code, read [Wallet integration](/wallet/overview), [Amounts and currencies](/wallet/amounts) and [Idempotency](/wallet/idempotency). **Tip —** Use the playground on these pages to fire signed requests at **your own** implementation: set the `host` server variable to your callback host. contact: name: Zero-Dash Integrations email: info@zerodash.studio servers: - url: https://{host} description: >- Your wallet host. Point this at your own environment to test your implementation. If you mount the endpoints under a path prefix (for example /zerodash/v1), include it in the host value — the full registered path is what gets signed. variables: host: default: wallet.example-operator.com description: The host you register with Zero-Dash, including any path prefix. security: - signature: [] timestamp: [] tags: - name: Wallet description: Player authorization and the money movements of a game round. - name: Troubleshooting description: Endpoints Zero-Dash uses to reconcile state after a failure. paths: /player: get: tags: - Wallet summary: Player authorization description: >- Called once when a player opens a game. Validate the launch `token`, then return the player's identity and current balance. Reject the request if the token is unknown, expired or belongs to a different player — the game will refuse to start. The `accountId` you return here is the identity Zero-Dash uses for every bet, transaction, report and audit for the lifetime of that player. See [Account ID](/wallet/account-id). operationId: playerAuthorization parameters: - name: gameId in: query required: true description: Human-readable game slug the player is opening. schema: type: string examples: - lucky-duck - name: token in: query required: true description: The session token you generated and passed to the launch URL. schema: type: string responses: '200': description: Player authorized. content: application/json: schema: $ref: '#/components/schemas/PlayerResponse' example: accountId: acct_8f2c19 displayName: Matthew S. balance: amount: 12.45 currency: USD updatedAt: '2026-01-29T14:05:29.678Z' subOperatorId: '9' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '500': $ref: '#/components/responses/InternalError' components: schemas: PlayerResponse: type: object required: - accountId - displayName - balance properties: accountId: type: string description: >- Unique, permanent, non-personal player identifier. One account ID maps to exactly one currency. See [Account ID](/wallet/account-id). displayName: type: string description: >- Name shown to other players in the same session. Must not expose personal data. examples: - Matthew S. balance: $ref: '#/components/schemas/Balance' subOperatorId: type: string description: >- Optional. When several brands sit behind one integration, identify the player's brand here — the games use it to separate chat rooms and similar shared surfaces. examples: - '9' Balance: type: object required: - amount - currency description: The player's balance **after** the operation was applied. properties: amount: oneOf: - type: number - type: string description: >- Most recent decimal balance, for example `12.45` USD or `0.00000123` BTC. examples: - 95 currency: type: string description: ISO-4217 currency code. examples: - USD updatedAt: type: string format: date-time description: When the balance was last updated (ISO-8601 UTC). Error: type: object description: Error body. Use this shape wherever possible so failures are actionable. properties: message: type: string description: Human-readable explanation of the failure. responses: BadRequest: description: Invalid request payload format. Include an explanation in the body. content: application/json: schema: $ref: '#/components/schemas/Error' example: message: missing field gameRoundId Unauthorized: description: >- Signature mismatch, stale timestamp, or source IP outside the Zero-Dash allowlist. content: application/json: schema: $ref: '#/components/schemas/Error' example: message: invalid signature InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' example: message: internal error securitySchemes: signature: type: apiKey in: header name: X-Zd-Signature description: >- Hex-encoded `HMAC-SHA512(apiPath|timestamp|data, secretKey)` computed by Zero-Dash. **Recompute it and compare before doing anything else.** See [Request signature](/security/signature). timestamp: type: apiKey in: header name: X-Zd-Timestamp description: >- Unix time in **milliseconds**, and the exact value that was signed. Reject requests older than 5 minutes. ````