Launch

Launch is the single entry point to the integration. Your backend calls it; we return a ready-to-embed iframe url. This is our endpoint — the operator's backend is the caller.

The flow

1. A logged-in player on your site opens the sportsbook.
2. Your backend calls POST /api/launch, authenticated with your site API key, passing the player's context (userId, currency, lang, …).
3. We mint a short-lived player session token and build the embed URL around it.
4. We respond with { url, token, expiresAt }.
5. Your page embeds the returned url in an <iframe> — verbatim. See Embedding.

Server-to-server only

Launch is authenticated with your site API key (Authorization: Bearer <YOUR_SITE_API_KEY>). Call it from your server, never the browser — shipping the key to the client would expose it to every visitor. Only the returned url (which carries a short-lived token) ever reaches the browser.

Endpoint

POST https://api.oddyne.com/api/launch

Auth: Authorization: Bearer <YOUR_SITE_API_KEY> — the per-site API key issued to you at onboarding.

Request body

JSON, camelCase:

{
  "siteId": "<YOUR_SITE_ID>",
  "userId": "<YOUR_PLAYER_ID>",
  "username": "player_display_name",
  "currency": "USD",
  "lang": "en",
  "partner": "affiliate-name",
  "template": "classic",
  "device": "desktop",
  "view": "live",
  "balance": 100.00
}

Field	Type	Required	Notes
siteId	string	Yes	Your site id. Must match the site the API key belongs to.
userId	string	Yes	Your internal player id. A valid launch always carries a real player.
username	string	No	Player display name shown in the UI.
currency	string	No	ISO currency code, e.g. USD.
lang	string	No	Language code, e.g. en.
partner	string	No	An affiliate / brand tag. Used for risk grouping.
template	string	No	Theme / branding selector.
device	enum	No	mobile | desktop | terminal. Default desktop.
view	enum	No	live | prematch | tickets. Default live.
balance	number	No	Player's starting balance to display.

Browse-only sessions

Keep it simple in v1: a valid launch always carries a userId. There is no separate anonymous flow — every launch is for a real player.

Request example

curl -X POST https://api.oddyne.com/api/launch \
  -H "Authorization: Bearer <YOUR_SITE_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "siteId": "<YOUR_SITE_ID>",
    "userId": "<YOUR_PLAYER_ID>",
    "username": "player_display_name",
    "currency": "USD",
    "lang": "en",
    "device": "desktop",
    "view": "live"
  }'

Response 200

JSON, camelCase:

{
  "url": "https://<EMBED_HOST>/?siteId=<YOUR_SITE_ID>&token=<jwt>&lang=en&theme=classic&view=live&device=desktop",
  "token": "<jwt>",
  "expiresAt": "2026-08-09T12:00:00Z"
}

Field	Type	Notes
url	string	The ready-to-embed iframe URL. Embed this exactly — do not modify or reconstruct it.
token	string	The signed player session JWT (already embedded in url; returned separately for reference). Short-lived.
expiresAt	string	ISO-8601 UTC expiry. Mint a fresh launch per player session.

We build the URL — not you

The url already contains siteId, token, lang, theme, view, and device. You do not assemble it yourself and you do not append your own parameters. Embed the url verbatim.

Errors

Status	Meaning
400	A required field (siteId or userId) is missing.
401	Missing or invalid site API key.
403	siteId does not match the site the API key belongs to.

Next step

Embed the returned url — see Embedding. Then wire up the wallet callbacks so bets settle against your ledger.