Getting started/Environments & IP allowlist
Environments & IP allowlist
There are two environments: Test (staging) and Live (production). The environment is determined by the API address you call. Keys, callback addresses, the IP allowlist and webhooks are separate for each environment.
Environments
| Test (staging) | Live (production) | |
|---|---|---|
| API address (example) | https://staging.example.com | https://api.example.com |
| Key prefix | pk_test_ | pk_live_ |
| Wallet | Callbacks go to your Test wallet address. Use test players and test balances. | Callbacks go to your Live wallet address; real money moves. |
| IP allowlist | Open while empty, enforced once it has entries. | Required. An empty list rejects every request. |
| Sites | Sites in Test and Live status open games. | Only sites in Live status open games; others get 403 SITE_DISABLED. |
| Invoicing | Not invoiced. | Invoices are issued from Live data only. |
- Addresses: the API addresses in the table are examples. The Test and Live API addresses of your account are shown at the top of the Integration & API page of the portal, for the selected environment; the portal address is sent to you when your account opens. In the code samples, BOSS_API_URL holds this address.
- Portal sign-in: first an access check with a one-time code sent to your email address, then your Boss Hub email address, password and, if enabled, your two-step verification code. The Test / Live switch in the top bar decides which environment each setting on the screen is written to.
- Game address: launch_url opens on the API address and redirects the player to the game client. EGT games load from play.denovra.com. If you open the game in an iframe, allow both addresses in your CSP frame-src.
- Your callbacks come from the Boss Hub egress IPs; these addresses are on the IP allowlist card of the portal.
Per-environment and shared settings
- Per environment: API key and secret, wallet settings (callback address, lobby and deposit addresses, timeout), IP allowlist, webhook endpoints, test data. A Test event never reaches a Live address.
- Shared: sites and site settings, bet limits, game and provider availability rules, lobby categories, game features. Changing them with a Test key changes Live too.
- Signing: callbacks are signed with the signing key of that environment. A Test call is never signed with a Live secret.
- Per site: you can define separate wallet settings or IP entries for a site. A site’s wallet settings replace the operator settings for that site.
Wallet settings
| Setting | Values | Note |
|---|---|---|
| Callback base URL | https://staging-api.meridyen.example/bossgaming | /authenticate, /balance, /bet, /win, /rollback are appended to it. HTTPS only, Test included; private and internal network addresses are blocked. |
| Lobby URL | https://meridyenbet.example/casino | Used when a launch request has no lobby_url. |
| Deposit URL | https://meridyenbet.example/deposit | Used when a launch request has no deposit_url. |
| Supported currencies | USD, EUR, TRY | See Currencies & languages. |
| Timeout | 3 s (default), 5 s | How long each attempt waits. |
| Retries | 2 (default), 3 | Retries after the first bet attempt. All attempts must fit a budget of at most 20 s. |
IP allowlist
Only the listed IPs can reach the API. On the IP allowlist card of the portal, add a single address (185.22.14.10) or a CIDR range (203.0.113.0/24). A request from outside the list gets 403 IP_NOT_ALLOWED.
- An operator-wide entry applies to all your keys.
- An IP entry on a site page applies only to keys bound to that site. If you call with an operator-wide key, add the address to the operator-wide list.
Live: The IP allowlist is required. Production cannot be requested without at least one entry, and an empty list rejects every request. The last operator-wide Live IP cannot be deleted.
The reverse direction needs an allowance too: your callbacks come from the Boss Hub egress IPs. These addresses are shown on the same card; add them to your firewall.
Going live
| Step | Condition |
|---|---|
| 1. Test key | Created automatically when your account opens; the secret is shown once, on first view. |
| 2. Test wallet | Save the operator-wide wallet settings in the Test environment (the test suite does not read site settings) and make Test connection succeed. |
| 3. Test suite | Enter the test data and run the suite. All 42 scenarios of the latest run must be PASS. |
| 4. Live IP | Add at least one IP in the Live environment (operator-wide or site). |
| 5. Request production | The Request production button opens when steps 3 and 4 are done. Boss Hub checks your company documents (KYB) and approves. |
| 6. After approval | Create a Live key, save the Live wallet settings (operator-wide or site), add webhooks. |
| 7. Take the site live | Set the site status to Live. Conditions: production approval, a market on the site that is not Test-only, a Live IP and Live wallet settings. |
Before approval, only the IP allowlist, sites, company details and test actions can be written in Live; Live writes such as keys, wallet settings, webhooks and campaigns get 403 PRODUCTION_NOT_APPROVED.
Taking a provider live is a separate step: in the portal, a provider’s Go live button opens once the latest test run (for that provider or operator-wide) has fully passed. On Live, only games of providers taken live can be opened.
Sites
- You add your sites yourself on the Sites page of the portal, up to the limit in your contract. A new site starts in Test status.
- In the API, site_id is the site’s code (e.g. site_mrd01); it is shown on the site details in the portal.
- If you have several sites, send site_id on launch, game list and recommendation requests; with one site it is inferred. A key bound to a site sees only its own site.
- Each site carries its own currencies, market and, if you want, its own wallet settings. Sites that share one callback address are told apart by site_id in the callback body.