B2B API DOCUMENTATIONv2.0

Developer integration guide for B2B Seamless Wallet clients.

SECURE HMAC-SHA256

1GAME SESSION LAUNCH API

To initialize an Aviator game session, the MelBet server makes a server-to-server HTTP POST request.

METHOD: POST

ENDPOINT: https://turboaviator.com/api/b2b/launch

HEADERS: Content-Type: application/json

Request Payload JSON:

{
  "operator_key": "melbet",
  "secret_key": "YOUR_OPERATOR_SECRET_KEY",
  "player_id": "unique_player_id_123",
  "player_username": "player_username",
  "currency": "LKR",
  "balance": 1500.00
}

Response Payload JSON:

{
  "success": true,
  "token": "session_jwt_token_here",
  "launch_url": "https://turboaviator.com/game/aviator?token=session_jwt_token_here"
}

2SEAMLESS WALLET CALLBACKS

During gameplay, SunilBet will query MelBet's callback URL using a signed request format.

METHOD: POST

ENDPOINT: Configured Callback URL (e.g. MelBet API)

HEADERS: X-Sign: <HMAC-SHA256 signature>

A. Debit Action (Bet Placement)

{
  "action": "debit",
  "operator_key": "melbet",
  "player_id": "unique_player_id_123",
  "amount": 100.00,
  "currency": "LKR",
  "transaction_id": "bet_unique_tx_id",
  "round_id": "game_round_id",
  "game_name": "aviator",
  "timestamp": 1784361468
}

B. Credit Action (Win Payout)

{
  "action": "credit",
  "operator_key": "melbet",
  "player_id": "unique_player_id_123",
  "amount": 250.00,
  "currency": "LKR",
  "transaction_id": "win_unique_tx_id",
  "round_id": "game_round_id",
  "game_name": "aviator",
  "multiplier": 2.50,
  "timestamp": 1784361500
}

3SIGNATURE SECURITY VERIFICATION

Validate every callback request payload using HMAC-SHA256 with the assigned `secret_key` on the MelBet server.

const crypto = require('crypto');

// Signature verification middleware
function verifyCallbackSignature(req, res, next) {
  const signature = req.headers['x-sign'];
  const rawBody = JSON.stringify(req.body);
  const SECRET_KEY = "YOUR_OPERATOR_SECRET_KEY";

  const computed = crypto
    .createHmac('sha256', SECRET_KEY)
    .update(rawBody)
    .digest('hex');

  if (signature !== computed) {
    return res.status(401).json({ success: false, message: "Invalid signature" });
  }
  next();
}