Game Reseller API

Everything a reseller needs: register players, launch games, and move funds — with the same JSON envelope on every call.

Base URL

https://game.rongops.com/api

All endpoints are POST with an application/json body. /api/ping accepts any method and needs no credentials.

Authentication

The platform administrator issues one API key and secret per reseller. There are two ways to prove who you are.

1. Key + secret headers

X-API-KEY: gk_live_9f2c...
X-API-SECRET: 7b1e...

2. Key + body signature (recommended)

Keep the secret off the wire. Send the key and an HMAC-SHA256 of the raw request body, keyed by the secret:

X-API-KEY: gk_live_9f2c...
X-SIGNATURE: 4f8d1c...   # strtolower(hash_hmac('sha256', $rawBody, $secret))

Hex and base64 signatures are both accepted; a sha256= prefix is optional.

Request format

Every response uses the same envelope:

{
  "status": true,
  "message": "OK",
  "data": { ... }
}

Failures put a machine-readable code next to the message:

{
  "status": false,
  "code": "insufficient_balance",
  "message": "The player balance is 50.00; cannot withdraw 100.00."
}

Error codes

POST /api/ping

Health check. No authentication.

{ "status": true, "data": { "service": "RONGOPS Game API", "time": "2026-11-13T10:00:00+06:00" } }

POST /api/providers

The active game catalogue. Pass one of these code values as provider when launching. Omitting it uses the default exchange.

{ "providers": [ { "code": "exchange", "name": "BetAPI Exchange", "vendor_code": "exchange", "logo": "" } ] }

POST /api/create-player

curl -X POST 'https://game.rongops.com/api/create-player' \
  -H 'X-API-KEY: gk_live_...' -H 'X-API-SECRET: ...' \
  -H 'Content-Type: application/json' \
  -d '{"player_id":"player001","name":"Rahim"}'

{
  "status": true,
  "message": "Player created.",
  "data": {
    "player_id": "player001",
    "username": "RSL123456_player001",
    "name": "Rahim",
    "currency": "BDT",
    "balance": 0,
    "status": "active",
    "created_at": "2026-11-13 10:00:00"
  }
}

POST /api/game-url (alias: /api/launch)

{
  "status": true,
  "message": "Game launched.",
  "data": {
    "player_id": "player001",
    "username": "RSL123456_player001",
    "game_url": "https://...",
    "provider": "exchange"
  }
}

Open game_url in an iframe or redirect the player to it. Treat it as short-lived: request a fresh URL on every launch.

POST /api/balance

{
  "status": true,
  "data": {
    "player_id": "player001",
    "balance": 500,        // your ledger
    "currency": "BDT",
    "game_balance": 480.5  // live balance inside the game
  }
}

POST /api/deposit

curl -X POST 'https://game.rongops.com/api/deposit' \
  -H 'X-API-KEY: gk_live_...' -H 'X-API-SECRET: ...' \
  -H 'Content-Type: application/json' \
  -d '{"player_id":"player001","amount":500,"reference":"ORD-10001"}'

{
  "status": true,
  "message": "Deposit credited.",
  "data": {
    "player_id": "player001",
    "type": "deposit",
    "amount": 500,
    "reference": "ORD-10001",
    "transaction_id": 42,
    "status": "success",
    "balance": 500,
    "currency": "BDT",
    "duplicate": false
  }
}

POST /api/withdraw

Same fields as deposit. The player's ledger balance must cover the amount.

{
  "status": true,
  "message": "Withdrawal completed.",
  "data": { "type": "withdraw", "amount": 100, "balance": 400, "duplicate": false, ... }
}

POST /api/transactions

{ "transactions": [ { "transaction_id": 42, "type": "deposit", "amount": 500,
    "reference": "ORD-10001", "status": "success", "created_at": "2026-11-13 10:05:00" } ],
  "total": 1, "page": 1, "limit": 50 }

POST /api/players

Paged list of your players. Accepts page and limit.

{ "players": [ { "player_id": "player001", "username": "RSL123456_player001",
    "balance": 400, "status": "active" } ], "total": 1, "page": 1, "limit": 50 }

Idempotency

Every deposit and withdrawal requires a reference. The platform stores it with the transaction and enforces uniqueness per reseller:

• A retry with the same reference after success returns the original result with "duplicate": true and moves no money.
• A retry after a failed attempt returns reference_failed. Use a fresh reference to try again.
• Two simultaneous retries cannot both succeed — the second sees the first's row.

Integration flow

1. Call /api/create-player once when a user signs up.
2. Call /api/deposit with your order id when the user pays.
3. Call /api/game-url when the user opens a game.
4. Call /api/balance before showing a withdrawal form.
5. Call /api/withdraw with a new reference for each payout.
6. Reconcile with /api/transactions.