Getting Started

Getting Started

To use the Slots Launch API and embed demo games on your site, you need a Slots Launch account.

Important: API is for synchronization, not live loading

The Slots Launch API is designed for synchronization, not serving games to visitors in real time.

To use the API correctly:

1. Fetch all available games once and store them in your database.
2. Call the /api/games  endpoint periodically — typically once per day — ordered by the updated_at  field to retrieve only new or modified records.

This keeps your integration up to date while staying within rate limits. Using the API as a live source for every page load may lead to throttling or access suspension.

Authentication overview

Every integration uses two credentials from Launch Pad → API:

• Register each website domain under Launch Pad → API before use.
• For every API request, send your API key and an Origin header matching that registered domain (without www. ).
• Sites that share the same API key also share the same API secret.

Upgrade timeline (signed requests)

Starting November 15, 2026, iframe embeds and API calls must be signed on your server using your API secret.

We recommend migrating before the deadline. If you need more time, contact support.

WordPress users: update to the latest Slots Launch plugin when available — it will handle signing for you.

Signed iframe embeds (required after Nov 15, 2026)

Do not use a static URL like:

https://slotslaunch.com/iframe/45958?token=YOUR_API_KEY

Generate a signed iframe URL on your backend when you render the page:

https://slotslaunch.com/iframe/{game_id}?token={api_key}&exp={unix_timestamp}&sig={signature}

Iframe signature payload

Build the payload with line feeds (\n ) between each line:

{game_id}
{exp}
{site_domain}

• site_domain  = your registered website name without www.  (must match Launch Pad).

PHP — signed iframe URL

$gameId = 45958;
$apiKey = 'your-api-key';
$apiSecret = 'your-api-secret'; // Launch Pad → API
$siteDomain = 'yourdomain.com';
$ttl = 3600;

$exp = time() + $ttl;
$payload = $gameId . "\n" . $exp . "\n" . $siteDomain;
$sig = hash_hmac('sha256', $payload, $apiSecret);

$url = 'https://slotslaunch.com/iframe/' . $gameId
    . '?token=' . urlencode($apiKey)
    . '&exp=' . $exp
    . '&sig=' . $sig;

<iframe src="<?php echo htmlspecialchars($url); ?>" width="100%" height="600" frameborder="0"></iframe>

Android / iOS apps

Do not put the API secret in your app. Your backend should sign the URL and return it to the app. Load that URL in a WebView the same way you load any iframe today.

Testing from Launch Pad

Game pages in Launch Pad include a short-lived Preview Embed Link for testing. Production embeds must always be signed by your own server.

Signed API requests (required after Nov 15, 2026)

In addition to ?token=  and the Origin  header, send these headers on every API call:

API signature payload

{timestamp}
{HTTP_METHOD}
{path}

• HTTP_METHOD  is uppercase (GET , POST , …).
• path  includes the leading slash, e.g. /api/games  — no query string.
• The timestamp must be within about 5 minutes of server time.

Sign with the same API secret used for iframe URLs.

PHP example — GET /api/games

If your API key is 12345abc  and your origin host is yourdomain.com :

<?php

$apiKey = '12345abc';
$apiSecret = 'your-api-secret';
$origin = 'https://yourdomain.com';
$path = '/api/games';
$method = 'GET';
$timestamp = time();

$payload = $timestamp . "\n" . $method . "\n" . $path;
$signature = hash_hmac('sha256', $payload, $apiSecret);

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://slotslaunch.com/api/games?token=' . urlencode($apiKey),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => '',
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 0,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'Accept: application/json',
        'Origin: yourdomain.com',
        'X-SL-Timestamp: ' . $timestamp,
        'X-SL-Signature: ' . $signature,
    ],
]);

$response = curl_exec($curl);
curl_close($curl);
echo $response;

JavaScript — server-side only

Do not call the Slots Launch API from the browser with your API secret. JavaScript in the visitor’s browser cannot hold the secret safely.

Use JavaScript on your backend (Node.js, etc.) with the same signing logic as PHP, or proxy requests through your server.

If you only need to display a game, sign the iframe URL on your server and output a normal <iframe>  tag — no client-side API calls required.

Node.js example — GET /api/games

const crypto = require('crypto');

const apiKey = '12345abc';
const apiSecret = 'your-api-secret';
const origin = 'yourdomain.com';
const path = '/api/games';
const method = 'GET';
const timestamp = Math.floor(Date.now() / 1000);

const payload = `${timestamp}\n${method}\n${path}`;
const signature = crypto.createHmac('sha256', apiSecret).update(payload).digest('hex');

const url = `https://slotslaunch.com/api/games?token=${encodeURIComponent(apiKey)}`;

const response = await fetch(url, {
    method: 'GET',
    headers: {
        'Content-Type': 'application/json',
        'Accept': 'application/json',
        'Origin': origin,
        'X-SL-Timestamp': String(timestamp),
        'X-SL-Signature': signature,
    },
});

const data = await response.json();

General rules

• Always cache API responses on your side.
• API queries are rate-limited (approximately 2 req/s for premium plans).
• You must use Slots Launch iframe URLs (https://slotslaunch.com/iframe/… ) on your site. Using our service to extract final game URLs without our iframe is prohibited and may result in account suspension.
• We may terminate API access without prior notice if we detect misuse.
• Obtain your API key and API secret from Launch Pad → API. Enter your website’s domain (without www. ) when adding a site.

Partner tournaments

If you use partner tournaments, player actions (register, wallet, etc.) use the same API secret with their existing HMAC body format, plus the X-SL-Timestamp  and X-SL-Signature  headers on each HTTP request. See the Partner Tournaments integration guide for details.

Need help?

• Launch Pad → API — manage websites, API key, and API secret.
• Launch Pad → docs — signed embed guide (when logged in).
• Support — contact us if you cannot migrate before the deadline; legacy mode may be available for your account.