Elitehubz Merchant Integration — FAQ

General

What is this document for?

It's the integration guide for Site Operator connecting to Elitehubz's Seamless/Transfer wallet service — covering game listing, game/widget launch, wallet callbacks (bet/win/refund), free spins, bet data reporting, and the newer Transfer Wallet integration.

What's the difference between Seamless Wallet and Transfer Wallet integration?

• Seamless Wallet: the Provider calls back to the Site Operator in real time for every balance-changing action (auth, balance, deduct, win, refund, etc.). The player's balance always lives on the Site Operator's side.
• Transfer Wallet: the Site Operator "transfers" funds into a provider-managed wallet (deposit/withdrawal model) after registering the player via a Register API. It uses the same signature-signing and callback response format as Seamless.

What are "Provider," "Player," "Site Operator," "Game Round," and "Round Transaction"?

• Provider — the game supplier integrated into the Seamless service.
• Player — the end customer.
• Site Operator — the brand/operator offering the games.
• Game Round — one full game transaction/session.
• Round Transaction — one of potentially several balance-changing events within a Game Round.

Authentication & Signing

How is every request/response signed?

1. Convert the JSON POST body into a sorted, URL-encoded query string (Pascal-case property names, lowercase-encoded values), excluding empty parameters.
2. Append | plus the current timestamp in milliseconds. (Timestamp must always be latest ~ 10 seconds allowed difference)
3. Hash the result with SHA256 using the shared Secret Key, and Base64-encode the output.
   You may verify the hash created here (https://www.devglan.com/online-tools/hmac-sha256-online)
4. Send the hash in header X-Sign and the timestamp in header X-Ts on both the request and response.

Are sample implementations of the sorted query-string signing available?

Yes — the Appendix includes sample code in C#, JavaScript, Go, and PHP.

What HTTP status codes should I expect?

200 = success. 400 = bad parameter, invalid signature, or other error (check the Message field and the Appendix error-code table for specifics).

What does a standard response envelope look like?

{ "Code": 0, "Message": "string", "Value": {DATA} }

Code: 0 = success; non-zero values map to the error-code appendix.

Game & Provider Listings

How do I get the list of games enabled for my site?

POST {Provider API URL}/api/sm/services/games — filterable by ProviderCodes, GameTypes, GameCategories, and flags like HasDemo/HasFreespin/HasFreechip/HasJackpot. Paginated, up to 1,000 records per page

What's the difference between the two provider-list endpoints?

• 1.2 Game Provider list — providers enabled for your site.
• 1.3 Game Provider list (ALL) — all providers available on the platform, including extra fields like GameTypes and SupportedCurrencies.

Widgets (Sportsbook)

What is the Widget API for? It lets Site Operators retrieve sportsbook widgets (e.g., IBC SABA, WBET, SBOBET, BTI) via POST {Provider API URL}/api/sm/services/widget.

What widget rendering modes exist?

• EMBED (1) — a script/iframe embedded directly on the operator's page.
• REDIRECT_SINGLE (2) — a single hosted launch URL.
• REDIRECT_MATCHES (3) — a list of featured matches, each with either a direct RedirectUrl or a MatchId requiring a follow-up call.

Why would RedirectUrl be missing from a match in REDIRECT_MATCHES?

Some providers generate launch URLs dynamically per match. In that case only MatchId is returned, and the Site Operator must call the Widget API again with that MatchId to get a fresh launch URL immediately before redirecting the player — these URLs are often single-use/short-lived and should never be cached or reused.

Launching Games (Seamless)

How do I launch a specific game vs. a lobby?

• 2.1 Start game launches a specific GameCode directly.
• 2.2 Start Lobby opens a lobby (optionally filtered by ProviderCode, GameType, or set to IsProviderLobby/IsStatic); passing an optional GameCode here also supports direct-launch-into-a-game from the lobby endpoint.

What are the constraints on AuthToken?

Max 20 alphanumeric characters (as of v1.9.9.2). It's the token the Provider will echo back to the Site Operator during the /auth callback for player authentication before returning the launch game URL.
So provider need to make sure their /auth endpoint is working.

What happens if I supply an invalid GameCode for direct launch?

The request is rejected — the game code must exist, come from the Game List API, and belong to a provider assigned to that site.

Seamless Wallet Callbacks

What callback endpoints does the Site Operator need to build?

/auth, /balance, /deduct, /win, /refund, /complete, /refreshtoken, /promowin, /wallet, /reopenround, and batch variants (/batch/deduct, /batch/win, /batch/promowin, /batch/refund, /batch/complete).

How is idempotency handled for callbacks?

The combination of Game Round ID + Transaction ID + Type must be treated as unique. If the same combination is received again, don't reprocess it — return the same response given the first time.

What does the /auth callback do, and what player fields does it return?

It authenticates the player using the AuthToken from game launch and returns PlayerCode (max 40 lowercase alphanumeric), Nickname, SessionToken, Currency, Balance, City, Country, and Ip.

What's the difference between /deduct, /win, /refund, /complete, and /wallet?

• /deduct — takes money from the player (Bet, Gift, Reserve, Reserve Bet).
• /win — credits the player (Win or Resettle); check the CreditToWallet flag before crediting.
• /refund — reverses money (Cancel Round, Cancel Round Transaction, Unsettle, Adjust, Release Reserve); supports negative balances in most cases.
• /complete — signals a Game Round has ended, sometimes with a total payout (TotalPayout); also respects CreditToWallet.
• /wallet — a standalone Debit/Credit transaction that is always its own complete round (independent of bet/win flow).

What are the two Deduct flows?

1. Normal: Bet → Win.
2. Reserve flow: Reserve → Reserve Bet(s) → (Refund) Release Reserve → Win. Once a round has a reserve, plain Bet isn't allowed — subsequent reserve bets draw from the reserved amount instead of the wallet directly.

How does "Reserve Bet Rounding Tolerance" work?

It's the acceptable rounding margin when releasing unused reserve funds. Example: reserved amount 100, tolerance 0.01 — if bets total 100.01 (within tolerance), nothing is returned to the player; if bets total 100.02 (exceeds tolerance), it's treated as an "Insufficient Reserve Amount" error.

What does RefundPreviousWin do on /win?

When set on a Resettle (Type: 3) callback, it deducts the previously credited win amount before applying the new (resettled) win amount.

What's the difference between Unsettle and a normal refund in a resettle flow?

Unsettle is an intermediate step that reverses a specific prior Win/Resettle transaction (always a negative amount) so a new resettle can be applied afterward, without doing a full round cancellation.

What does /reopenround do, and what does RestorePrevWin control?

It reopens a previously refunded/cancelled round after a provider-side resettlement. RestorePrevWin: true re-applies the previous win amount to the player's balance on reopen; false does not — the doc includes worked balance examples for both cases.

What does CompleteRound mean on /wallet and /win?

It flags whether that transaction closes out the game round. On /wallet, it's always true since each wallet callback is independent and self-contained.

How do the batch callbacks (/batch/deduct, /batch/win, etc.) work?

They send an array of transactions (possibly across multiple players) in one call, with two flags:

• ProcessInSequence — whether transactions must be processed in order.
• AllMustSuccess — whether one failure fails the whole batch. The response has two layers of Code/Message: an outer batch-level status and an inner per-transaction result.

What does /refreshtoken do?

Lets the Provider retrieve the player's latest session token and balance mid-session.

What is /promowin for?

Crediting (or, if the amount is negative, deducting) a promotional win that has no prior bet transaction tied to it — e.g., a standalone bonus payout.

Transfer Wallet Integration

Do I need to do anything before using Transfer Wallet actions?

Yes — register each player via the Register Player API (4.1) first; it's idempotent (a duplicate username registration still returns success). On player signout, call the Signout Player API.

Does Transfer Wallet reuse the same signing and response format as Seamless?

Yes — identical request-signing method and callback response envelope.

What Transfer Wallet endpoints are available?

Register Player, Start game, Start Lobby, Get Balance, Deposit, Withdrawal, Transaction History, Signout Players, and Active/Deactivate Players (Sections 4.1–4.9).

Bet Data (Reporting)

How do I pull historical game round/transaction data?

POST {Platform API URL}/api/rp/reports/{site code}/betdata, filtered by ProviderCodes, StartDate/EndDate, and paginated (default page size 5000). Returns round-level data (status, balances, bet/win/gift totals) plus a nested array of individual Transactions per round.

Free Spin Campaigns

What's the general free-spin workflow?

Create a campaign, then assign players to it. Endpoints cover campaign list/detail/create/cancel, adding/removing players from a campaign, provider free-spin info, and available bet values per game (Section 3).

Currency Handling

Do all currencies use a 1:1 balance ratio? No. Some use conversion ratios that must be applied before responding to balance callbacks, e.g.:

• MYR100 (1:100) — the wallet balance is auto-converted in-game (site sends RM100, game shows 10,000).
• MYRC, VNDK, IDRK — the Site must pre-convert the balance itself before sending it in the callback response (e.g., site balance RM100 → callback balance 10,000). Contact EliteHubz support for the full currency/ratio list beyond what's listed (MYR, MYR100, MYRC, VNDK, IDRK, USD, EUR, AUD).