> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zerodash.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Onboarding

> What you exchange with Zero-Dash before the first line of code, and in what order to build.

Integration starts with a short exchange of credentials and endpoints. Get this right and the build is mechanical.

## What Zero-Dash gives you

<CardGroup cols={2}>
  <Card title="Operator ID" icon="id-badge">
    The value for the `X-Operator` header on every Customer API call.
  </Card>

  <Card title="Secret key" icon="key">
    Used to sign your requests **and** to verify our callbacks. Server-side only.
  </Card>

  <Card title="API host" icon="server">
    Separate hosts for staging and production.
  </Card>

  <Card title="Game provisioning" icon="grid-2">
    Which games are enabled for your account, visible through [List games](/api-reference/customer/list-games).
  </Card>
</CardGroup>

<Warning>
  The secret key is not a bearer token. It never goes into a URL, a browser, a mobile app, a log line or a stack trace. Store it where you store database credentials.
</Warning>

## What you give Zero-Dash

<CardGroup cols={2}>
  <Card title="Callback base URL" icon="link">
    The HTTPS base your five wallet endpoints are mounted on. This exact path is what gets signed — including any prefix such as `/zerodash/v1`.
  </Card>

  <Card title="Egress IP addresses" icon="network-wired">
    Optional but recommended. We reject Customer API calls from anywhere else. See [IP allowlist](/security/ip-allowlist).
  </Card>

  <Card title="Currencies" icon="coins">
    The ISO-4217 codes your players hold, so precision is configured correctly. See [Amounts](/wallet/amounts).
  </Card>

  <Card title="Technical contact" icon="user-gear">
    Someone reachable during certification and incidents.
  </Card>
</CardGroup>

<Note>
  Zero-Dash calls your wallet from `104.248.19.126` and `46.101.149.79`. Allowlist them before certification or every callback will time out.
</Note>

## Build order

Build in this order and each step is testable before the next one depends on it.

<Steps>
  <Step title="Signing, both directions" icon="key">
    Implement `sign` and `verify`, then check them against the vectors on [Request signature](/security/signature). Everything else is blocked on this working.

    <Check>Your implementation reproduces `be77138b…305d1b4e` for the canonical vector.</Check>
  </Step>

  <Step title="A signed call to List games" icon="cloud-arrow-up">
    The smallest end-to-end proof: your credentials work, your signature is accepted, your catalogue arrives.

    <Check>[`GET /api/v1/games`](/api-reference/customer/list-games) returns `200` with your provisioned games.</Check>
  </Step>

  <Step title="Player authorization" icon="user-check">
    Mount `/player`, verify the signature, validate your [session token](/launch/session-token), return an [account ID](/wallet/account-id) and balance.

    <Check>An unsigned or stale request is rejected with `401`.</Check>
  </Step>

  <Step title="First launch" icon="gamepad">
    Mint a token, call [Obtain game launch URL](/api-reference/customer/game-launch-url), open it in a new tab.

    <Check>The game loads and your `/player` handler logs a request.</Check>
  </Step>

  <Step title="The money path" icon="wallet">
    `/debit`, `/credit`, `/rollback` — idempotent, atomic, session-independent. Read [Wallet integration](/wallet/overview) and [Idempotency](/wallet/idempotency) first.

    <Check>A duplicate `transactionId` moves the balance once and returns the original result.</Check>
  </Step>

  <Step title="Free rounds" icon="gift">
    Only if your commercial setup includes them. See [Free rounds](/free-rounds/overview).
  </Step>

  <Step title="Certification" icon="circle-check">
    Work through the [go-live checklist](/go-live/checklist) with your integration contact.
  </Step>
</Steps>

## Environments

|             | Staging           | Production        |
| ----------- | ----------------- | ----------------- |
| API host    | Issued separately | Issued separately |
| Operator ID | Distinct          | Distinct          |
| Secret key  | Distinct          | Distinct          |
| Money       | Test wallets      | Real              |

<Warning>
  Keep the two sets of credentials strictly separated in configuration. A staging key against the production host is rejected as an invalid signature, which sends you looking for a bug that is not there.
</Warning>