Skip to main content
Zero-Dash does not hand out static game URLs. You mint one per launch, bound to the player’s session token and IP address, and open it in the browser.

The flow

Note what happens at the end: the Player authorization callback fires after the launch URL is opened. If that endpoint is not working, the launch URL still returns 200 and the game still opens — and then fails to start. When a launch appears to hang, check your /player handler first.

Launching

Get the game slug

From List games, cached. Slugs are stable, human-readable identifiers such as lucky-duck.

Mint a session token

Unique, non-deterministic, valid for at least 2 hours. See Session token.

Request the launch URL

Call Obtain game launch URL with the token, the player’s currency and the player’s real IP address.

Open it

A new tab or window is the supported path. An iframe works but carries requirements and caveats.
Call this endpoint at click time, not ahead of time. The URL is tied to the token and IP you passed in — pre-generating URLs for a whole catalogue page produces links that break as soon as anything about the session changes.

Launch parameters

Behind a CDN or load balancer, ipAddress must be the leftmost trustworthy entry of X-Forwarded-For, not the socket peer. Send your own egress IP and every player looks like they are in your datacentre — country restrictions will apply to the wrong jurisdiction.

Opening the game

Best compatibility and the best experience on every device.
The popup blocker only allows window.open during a user gesture. Open the blank tab first, resolve the URL after — the pattern above is the reason this works.

Failure modes

The slug is unknown or the game is not enabled for your account. Refresh your cached catalogue; if the slug is there and still fails, the game is not provisioned for you — contact integrations.
Almost always your /player callback: unreachable, returning a non-200, failing signature verification, or returning a balance in the wrong currency. Check your callback logs for a GET /player around the launch time.
Country restrictions, driven by ipAddress. Check restrictedCountries on the game in your cached catalogue against where the affected players actually are.
The session token expired or was invalidated. Tokens need at least 2 hours of validity and must survive a client reload. See Session token.