Skip to main content
Integration starts with a short exchange of credentials and endpoints. Get this right and the build is mechanical.

​
What Zero-Dash gives you

Operator ID

The value for the X-Operator header on every Customer API call.

Secret key

Used to sign your requests and to verify our callbacks. Server-side only.

API host

Separate hosts for staging and production.

Game provisioning

Which games are enabled for your account, visible through List games.
The secret key is not a bearer token. It never goes into a URL, a browser, a mobile app, a log line or a stack trace. Store it where you store database credentials.

​
What you give Zero-Dash

Callback base URL

The HTTPS base your five wallet endpoints are mounted on. This exact path is what gets signed — including any prefix such as /zerodash/v1.

Egress IP addresses

Optional but recommended. We reject Customer API calls from anywhere else. See IP allowlist.

Currencies

The ISO-4217 codes your players hold, so precision is configured correctly. See Amounts.

Technical contact

Someone reachable during certification and incidents.
Zero-Dash calls your wallet from 104.248.19.126 and 46.101.149.79. Allowlist them before certification or every callback will time out.

​
Build order

Build in this order and each step is testable before the next one depends on it.

Signing, both directions

Implement sign and verify, then check them against the vectors on Request signature. Everything else is blocked on this working.
Your implementation reproduces be77138b…305d1b4e for the canonical vector.

A signed call to List games

The smallest end-to-end proof: your credentials work, your signature is accepted, your catalogue arrives.
GET /api/v1/games returns 200 with your provisioned games.

Player authorization

Mount /player, verify the signature, validate your session token, return an account ID and balance.
An unsigned or stale request is rejected with 401.

First launch

Mint a token, call Obtain game launch URL, open it in a new tab.
The game loads and your /player handler logs a request.

The money path

/debit, /credit, /rollback — idempotent, atomic, session-independent. Read Wallet integration and Idempotency first.
A duplicate transactionId moves the balance once and returns the original result.

Free rounds

Only if your commercial setup includes them. See Free rounds.

Certification

Work through the go-live checklist with your integration contact.

​
Environments

Keep the two sets of credentials strictly separated in configuration. A staging key against the production host is rejected as an invalid signature, which sends you looking for a bug that is not there.