Tournaments

Partner tournaments integration guide

Tournaments run on Slots Launch. You fund prize pools, create events, register your logged-in players, and embed play in an iframe. Players never leave your UX for the game UI; scoring and payouts are handled by Slots Launch with a 5% fee, or handled on your end with a monthly fee.

A Neptune or higher plan is required

Base URL: https://slotslaunch.com/api  

Money units: All partner API amounts are USD dollars (e.g. 100   = $100.00  , up to 2 decimals).

Two ways to work

You do not need to implement every API endpoint. Launch Pad already covers funding, branding, tournament CRUD, and day-to-day ops.

Recommended split for most customers

1. Use Launch Pad for wallet, settings, and creating/activating tournaments.
2. Call the API only for the player play flow (register → bootstrap → iframe).
3. Add leaderboard / player wallet endpoints only if your product needs them.

Prerequisites

1. A Slots Launch account (Launch Pad → Tournaments is available to every account).
2. At least one website registered under Launch Pad → API Token / Manage Websites. The site hostname must match the Origin   you send on API calls (without www.  ).
3. Your site license token (same token used for the games embed API).
4. Your site tournament API secret (Launch Pad → Tournaments → Settings). Keep it server-side only.

Launch Pad screens

Authentication

Every partner request needs:

• Query parameter: token   = your site license token.
• Header: Origin   must match the registered site hostname (Site.name  , without www.  ).

Player actions that mutate state (register, rebuy, bootstrap, wallet, withdrawals) also require an HMAC-SHA256 signature using your API secret (Launch Pad → API / Tournaments → Settings; column tournament_api_secret  ). The same secret signs iframe URLs and X-SL-*   API headers. Signatures expire in about ±5 minutes.

Never put the tournament secret in frontend JavaScript. Always sign on your backend using the currently logged-in user’s stable id as external_id  .

Minimal integration (what you must build)

1. Create and activate tournaments (Launch Pad preferred)

In Launch Pad → Tournaments:

1. Fund your wallet (Tournaments → Wallet).
2. Create tournament — pick website, eligible game, dates, spins, prize pool, entry/rebuy settings.
3. Save as draft, then Activate (locks the prize pool from your balance).

Only games already used in a Slots Launch platform tournament are eligible (same list as the API).

You can still manage tournaments via API if you prefer automation:

1b. Create and activate via API (optional)

Only games already used in a Slots Launch platform tournament are eligible.

GET /api/partner/tournaments/eligible-games?token=YOUR_TOKEN&per_page=50&q=&provider_id=

Then:

POST /api/partner/tournaments?token=YOUR_TOKEN
Content-Type: application/json
Origin: https://your-site.com

{
  "name": "Weekly Sweet Bonanza",
  "description": "Optional",
  "game_id": 12345,
  "provider_id": 67,
  "start_date": "2026-04-14T00:00:00Z",
  "end_date": "2026-04-21T00:00:00Z",
  "duration_type": "weekly",
  "bet_level_type": "fixed",
  "bet_level": 1,
  "total_spins": 50,
  "total_prize": 1000,
  "entry_fee": 0,
  "rebuy_type": "unlimited",
  "rebuy_cost": 0
}

Tournaments are created as draft  . Fund the prize pool in Launch Pad → Wallet (balance must cover total_prize  ), then:

POST /api/partner/tournaments/{id}/activate?token=YOUR_TOKEN

Activation locks the prize by debiting your partner balance.

Create / update fields

Prize display labels are site-wide (Launch Pad → Settings), not per tournament.

2. Register a player (server-side)

When your logged-in user joins:

POST /api/partner/tournaments/{id}/register-player?token=YOUR_TOKEN

{
  "external_id": "user-42",
  "display_name": "LuckyLuna",
  "timestamp": 1710000000,
  "signature": "…",
  "country": "US"
}

• external_id   — stable id of your user (string). Never take this from an untrusted browser field; use the session user.
• country   — optional ISO 3166-1 alpha-2 (recommended for geo checks).
• timestamp   — Unix seconds.

Canonical string (register / rebuy):

{external_id}\n{timestamp}\n{tournament_id}

Signature: HMAC-SHA256 of that string with tournament_api_secret  , lowercase hex.

Examples

PHP

$canonical = "{$externalId}\n{$timestamp}\n{$tournamentId}";
$signature = hash_hmac('sha256', $canonical, $tournamentApiSecret);

Node.js

import crypto from 'crypto';

const canonical = `${externalId}\n${timestamp}\n${tournamentId}`;
const signature = crypto
  .createHmac('sha256', tournamentApiSecret)
  .update(canonical)
  .digest('hex');

Python

import hmac, hashlib

canonical = f"{external_id}\n{timestamp}\n{tournament_id}"
signature = hmac.new(
    tournament_api_secret.encode(),
    canonical.encode(),
    hashlib.sha256,
).hexdigest()

3. Bootstrap play and embed the iframe

POST /api/partner/tournaments/player-bootstrap?token=YOUR_TOKEN

{
  "tournament_id": 123,
  "external_id": "user-42",
  "display_name": "LuckyLuna",
  "timestamp": 1710000000,
  "signature": "…"
}

Canonical string:

{external_id}\n{display_name}\n{timestamp}\n{tournament_id}

Use an empty string for display_name   if unknown (still include the newline).

Response:

{
  "launch_token": "...",
  "launch_url": "https://slotslaunch.com/embed/tournaments/123/play?lt=..."
}

Embed launch_url   in an iframe on your site. The launch token is one-time and short-lived. The player must already be registered.

Keep the iframe. Do not open launch_url   as a top-level page for Safari/iOS. Scoring inside the embed does not need third-party cookies, so Safari, iOS, Brave, and Chrome Incognito record points. You do not send any extra headers or tokens.

If the player rebuys inside the embed, the iframe reloads play with a new launch token — no extra API call from you. If your backend calls rebuy-player  , call player-bootstrap   again and replace the iframe src   with the new launch_url  .

4. Rebuy (when your product offers it)

POST /api/partner/tournaments/{id}/rebuy-player?token=YOUR_TOKEN

Same signed fields as register (display_name   optional). Same canonical string as register/rebuy.

Recommended: leaderboard on your site

No HMAC — license token + Origin only.

GET /api/partner/tournaments/{id}/leaderboard?token=YOUR_TOKEN&limit=100

{
  "tournament": {
    "id": 123,
    "name": "Weekly Sweet Bonanza",
    "status": "active",
    "start_date": "2026-04-14T00:00:00+00:00",
    "end_date": "2026-04-21T00:00:00+00:00",
    "total_spins": 50,
    "total_prize": "1000.00"
  },
  "total_registrations": 842,
  "limit": 100,
  "entries": [
    {
      "position": 1,
      "external_id": "user-42",
      "display_name": "LuckyLuna",
      "best_total_points": 18420.75,
      "current_attempt_points": 12030.5,
      "spins_used": 48,
      "rebuy_count": 1,
      "registered_at": "2026-04-14T10:12:03+00:00",
      "last_played_at": "2026-04-19T21:45:11+00:00",
      "prize_won": null
    }
  ]
}

limit  / per_page  default to 100 and cap at 500. page  defaults to 1. Increase page  until it equals last_page  to read the full board. position  is the absolute rank. After the tournament ends, prize_won  is the paid USD amount for that player (null  if they did not cash). Safe to poll every 15–30s for live pages; cache when you can. Match external_id  to highlight the current user.

Player wallet & withdrawals

Use these if you want a “My tournament wallet / cash out” UI on your site. All are HMAC-signed and must be called from your backend.

Wallet

{
  "external_id": "user-42",
  "timestamp": 1710000000,
  "signature": "…"
}

Response includes balance and enabled redemption_methods   (recipient_type  : email   or wallet_address  ).

Withdrawal

{
  "external_id": "user-42",
  "timestamp": 1710000000,
  "signature": "…",
  "amount": 50,
  "method": "gifq_gift_card",
  "recipient": "[email protected]",
  "notes": "optional"
}

In the redemption signature:

• amount  — normalized USD with 2 decimals (50  → 50.00 )
• method  — exact string sent in JSON (e.g. gifq_gift_card , coinbase_cdp_usdc_base )
• recipient  — lowercase trimmed email or wallet address (same value sent in JSON)

Minimum is typically $20.00. Withdrawals are processed automatically (USDC on Base); on failure the API returns success: false  and the balance is refunded.

Why players cannot withdraw someone else’s balance

1. Your backend must set external_id  from the logged-in session only.
2. HMAC binds external_id , withdrawal amount, method, and recipient; forging another user’s id or redirecting payout details requires tournament_api_secret .
3. Players are scoped to your site + external_id .
4. Timestamps limit replay (~5 minutes).

Optional: settings & deposits via API

Skip these if you use Launch Pad.

Deposit fee

All deposits include a 5% fee:

• Declare amount   = credit you want (USD).
• Pay total_due   = amount + fee (e.g. credit $100   → send $105.00  ).
• Only the net amount   is credited.

Crypto (USDC on Base)

1. Optional: set crypto_sender_address   in Settings for a self-custody wallet.
2. Create intent → send exactly total_due   USDC on Base → confirm with tx_hash   (or wait for auto-match every ~5 minutes by unique amount).

Bank

Register a pending deposit, wire exactly total_due  , then Slots Launch credits after funds clear.

End-to-end flow

Launch Pad: fund wallet + settings + create/activate tournament
        │
        ▼
Logged-in user joins → register-player (signed)
        │
        ▼
User clicks Play → player-bootstrap (signed) → iframe launch_url
        │
        ▼
(optional) Poll leaderboard · show wallet · request withdrawal

UK age verification

Partner embeds use the same UK age gate as demo games. Visitors from GB / GI must verify before play loads. If the browser blocks third-party cookies they may see the gate on every launch — that is expected and does not block scoring. The return from the gate uses age_verified=1   on the play URL, not the cookie.

If you have the AgeChecked addon, enable it per website in Manage Websites (enable_av  ). No extra tournament API fields — verification runs on Slots Launch when the player opens launch_url  .

Security checklist

• 
  

  tournament_api_secret   only on your server

• 
  

  external_id   always from your auth session

• 
  

  Reject signed requests outside the timestamp window

• 
  

  Use HTTPS; send a correct Origin   for the licensed site

• 
  

  Partner tournaments are not on the public Slots Launch tournament index — only via your embed / API

Endpoint cheat sheet

Always needed for a custom site (player play)

Usually useful

Launch Pad can replace these

Optional player account UI

Support

Partner tournaments must be enabled on your account. For access, deposit issues, or eligible-game questions, contact your Slots Launch representative.