Getting Started



Getting Started (Direct Embeds)

To use Direct Embeds you need a Slots Launch account.


Direct Embeds let you display demo games on your website inside an iframe. You do not need to sync the full game catalog — only generate (or let a plugin generate) a valid iframe URL for each game.



How it works

  1. Register your website domain under Launch Pad → API (hostname without www.  ).
  2. Copy your API key and API secret from the same page.
  3. On your server (or via one of our WordPress plugins), create a signed iframe URL for the game you want to show.
  4. Put that URL in an <iframe>   on your page.

Every game load counts as one request toward your plan quota (including Free). We recommend a “Play for Free” / launch screen before loading the iframe — same pattern as our WordPress plugins — so crawlers and idle visitors do not burn quota.


It is forbidden to bypass the Slots Launch iframe URL to obtain the final game URL. Doing so may result in account suspension.



Credentials

Credential Where Use
API key (token  ) Launch Pad → API Goes in the iframe URL query string
API secret Launch Pad → API Server only — signs the URL. Never put this in HTML or browser JavaScript

Sites that share the same API key also share the same API secret.



Upgrade: signed embeds (required after November 15, 2026)

Until November 15, 2026, a token-only URL still works:


<iframe src="https://slotslaunch.com/iframe/5148?token=YOUR_API_KEY" width="100%" height="600"></iframe>

After that date, unsigned URLs are rejected unless legacy mode is enabled on your account. Signed URLs look like:


https://slotslaunch.com/iframe/{game_id}?token={api_key}&exp={unix_timestamp}&sig={signature}

Parameter Meaning
token   Your API key
exp   Unix expiry time (e.g. one hour from now)
sig   HMAC-SHA256 signature (hex)

Signature payload

Build with line feeds (\n  ) between each line:


{game_id}
{exp}
{site_domain}

  • site_domain   = your registered website without www.  

You can copy a Preview Embed Link or Copy Shortcode from any game page in Launch Pad. Production traffic must be signed by your server or by one of our plugins — not by pasting a long-lived preview URL into production HTML.


Full signing details (API headers, Node examples, etc.): Getting Started (API).



Easiest options (no custom backend)

WordPress — embeds only

Install the lightweight Slots Launch Embeds plugin:


  1. Upload / activate the plugin.
  2. Settings → Slots Launch Embeds — enter API key and API secret.
  3. Paste a shortcode into any post or page:

[slotslaunch_game id="5148"]

Optional: height="600"   width="100%"  . Alias: [slotslaunch id="5148"]  .


The plugin signs URLs on your WordPress server via AJAX, so full-page cache plugins do not serve expired signatures.


Need game sync, lobby, rankings, or tournaments? Use the main Slots Launch WordPress plugin instead (same signing rules).


Custom PHP sites

Use our small PHP library — no framework required:



use SlotsLaunch\Client;

$sl = new Client(
    apiKey: 'your-api-key',
    apiSecret: 'your-api-secret',
    siteDomain: 'yourdomain.com',
);

$url = $sl->iframeUrl(5148);


<iframe src="<?php echo htmlspecialchars($url); ?>" width="100%" height="600" frameborder="0"></iframe>

Sign when the page is rendered (or via your own AJAX endpoint). Do not bake a signed URL into HTML that full-page cache stores longer than the URL’s lifetime.


Next.js

Sign the iframe URL on the server (Route Handler or Server Component). Store credentials in .env.local  and do not prefix them with NEXT_PUBLIC_  — that would expose the API secret to the browser.


SLOTSLAUNCH_API_KEY=your-api-key
SLOTSLAUNCH_API_SECRET=your-api-secret
SLOTSLAUNCH_SITE_DOMAIN=yourdomain.com

SLOTSLAUNCH_SITE_DOMAIN  must match the hostname registered in Launch Pad (without www. ).


Next.js pages are often statically generated or CDN-cached. Sign from a Route Handler and fetch a fresh URL when the visitor clicks Play — same idea as the WordPress AJAX pattern, so signatures do not expire in cached HTML.


app/api/slotslaunch/embed/route.js :


import { createHmac } from 'crypto';

export async function GET(request) {
  const gameId = Number(request.nextUrl.searchParams.get('id'));
  if (!Number.isInteger(gameId) || gameId <= 0) {
    return Response.json({ error: 'Invalid game id' }, { status: 400 });
  }

  const apiKey = process.env.SLOTSLAUNCH_API_KEY;
  const apiSecret = process.env.SLOTSLAUNCH_API_SECRET;
  const siteDomain = process.env.SLOTSLAUNCH_SITE_DOMAIN;
  const ttl = 3600;

  const exp = Math.floor(Date.now() / 1000) + ttl;
  const payload = `${gameId}\n${exp}\n${siteDomain}`;
  const sig = createHmac('sha256', apiSecret).update(payload).digest('hex');

  const url = `https://slotslaunch.com/iframe/${gameId}`
    + `?token=${encodeURIComponent(apiKey)}`
    + `&exp=${exp}`
    + `&sig=${sig}`;

  return Response.json({ url });
}

Client component — load the iframe only after the visitor clicks:


'use client';

import { useState } from 'react';

export default function GameEmbed({ gameId }) {
  const [src, setSrc] = useState(null);

  async function play() {
    const res = await fetch(`/api/slotslaunch/embed?id=${gameId}`);
    const data = await res.json();
    setSrc(data.url);
  }

  if (!src) {
    return (
      <button type="button" onClick={play}>
        Play for Free
      </button>
    );
  }

  return (
    <iframe src={src} width="100%" height="600" frameBorder="0" />
  );
}


<GameEmbed gameId={5148} />

Server Component

If the page is rendered on every request (not statically generated), you can sign while rendering. Set dynamic = 'force-dynamic'  so next build  does not bake an expired signature into HTML.


import { createHmac } from 'crypto';

export const dynamic = 'force-dynamic';

function iframeUrl(gameId, ttl = 3600) {
  const apiKey = process.env.SLOTSLAUNCH_API_KEY;
  const apiSecret = process.env.SLOTSLAUNCH_API_SECRET;
  const siteDomain = process.env.SLOTSLAUNCH_SITE_DOMAIN;

  const exp = Math.floor(Date.now() / 1000) + ttl;
  const payload = `${gameId}\n${exp}\n${siteDomain}`;
  const sig = createHmac('sha256', apiSecret).update(payload).digest('hex');

  return `https://slotslaunch.com/iframe/${gameId}`
    + `?token=${encodeURIComponent(apiKey)}`
    + `&exp=${exp}`
    + `&sig=${sig}`;
}

export default function GamePage() {
  const url = iframeUrl(5148);

  return (
    <iframe src={url} width="100%" height="600" frameBorder="0" />
  );
}

Keep signing on the Node.js runtime (the Next.js default). Edge middleware and client components must not see the API secret.


Manual / other languages

If you prefer not to use the library, sign with HMAC-SHA256 on your backend using the payload format above. Keep the API secret on the server only.


Example (PHP without the library):


$gameId = 5148;
$apiKey = 'your-api-key';
$apiSecret = 'your-api-secret';
$siteDomain = 'yourdomain.com';
$ttl = 3600;

$exp = time() + $ttl;
$payload = $gameId . "\n" . $exp . "\n" . $siteDomain;
$sig = hash_hmac('sha256', $payload, $apiSecret);

$url = 'https://slotslaunch.com/iframe/' . $gameId
    . '?token=' . urlencode($apiKey)
    . '&exp=' . $exp
    . '&sig=' . $sig;


<iframe src="<?php echo htmlspecialchars($url); ?>" width="100%" height="600" frameborder="0"></iframe>


Quotas and best practices

  • Each iframe load counts toward your plan’s request quota.
  • Add a launch / “Play for Free” button so the iframe loads only when the visitor clicks.
  • Register the exact domain that serves the page (without www.  ).
  • Never put the API secret in front-end code.


Related links


Need more time after November 15, 2026? Contact support — legacy mode may be available for your account.

Did this answer your question? Thanks for the feedback There was a problem submitting your feedback. Please try again later.