Callback Validation

Every callback includes a key and a timestamp field, which must be used to verify the authenticity and freshness of the request.

Validation ensures that the callback:

• Originates from Slotsgateway
• Has not been replayed or delayed

⚠️ Security Requirement

• The received timestamp must be within the last 30 seconds
• If the timestamp is outside this window, you must reject the callback
• Rejected callbacks must return error 2
• Always respond with HTTP status code 200, even on errors

Signature Generation

The key is generated by hashing the timestamp together with your salt key.

• The salt key is unique per API key
• You can rotate or update it at any time in the
  Backoffice

Key Construction (JavaScript)

md5(timestamp + saltkey);

Key Construction (PHP)

md5($timestamp . $saltkey);

Validation Process

1. Read the timestamp and key from the callback
2. Verify the timestamp is no older than 30 seconds
3. Recreate the signature using the same timestamp and your salt key
4. Compare the generated signature with the received key
5. If validation fails, reject the callback

Invalid Signature / Timestamp Response

If the signature does not match or the timestamp validation fails, return:

{
  "error": 2,
  "balance": 0
}