Skip to content
KOI Games Developer
OpenAPI

Reference

Go-live checklist

Complete every item in the sandbox before requesting production credentials.

Launch

  • request-access is called only from your servers. The access token never reaches a browser.
  • A new session is opened for every launch.
  • game_url and session_token are not logged or sent to analytics.
  • currency and lang match the player's account.

Wallet

  • All four endpoints are registered and reachable over HTTPS.
  • X-Koi-Signature is verified on the raw body, in constant time, before any processing.
  • Bet answers arrive in under 10 seconds, balance checks in under 3 seconds.
  • Bets and wins are idempotent by provider_tx_id, rollbacks by linked_tx_id, with a unique constraint in your database.
  • Refusals use a non-2xx status with status: "DENIED" and a documented code.
  • Wins are credited even after the session expired.
  • A rollback for an unknown bet is accepted without moving funds.
  • Responses carry old_balance, new_balance and operator_tx_id.

Test rounds

Run and keep evidence of these cases with KOI in the sandbox:

CaseExpected
Bet and winBet debited once, win credited once.
Losing betBet debited, no win callback.
Insufficient fundsBet refused with INSUFFICIENT_FUNDS, no debit.
Bet timeoutBet retried once, then rolled back. Balance unchanged at the end.
Duplicate betSecond delivery returns the first result, no second debit.
Win retryWin delivered twice, credited once.
Invalid signatureRequest rejected, no wallet movement.
Free betsGrant a bonus, play all rounds: no bet or win callbacks, then one bonus_win with the total, credited once.
Free bets cancelledCancel after one round: one bonus_win with rounds_remaining above 0.

Reconciliation

  • You store KOI provider_tx_id, round_id and your operator_tx_id for every movement.
  • You have a contact for reconciliation questions.