Operator Credentials & Live Sandbox

Every casino that licenses Rocket Rush X gets a unique operator slug and HMAC secret. The credentials below belong to the public demo sandbox so you can exercise the production Wallet API end-to-end before signing the integration agreement.

1. Your credentials

2. Live sandbox

Hit the real POST /api/public/wallet/round endpoint. Requests are HMAC-signed server-side so the secret never leaves the backend.

3. Signed cURL samples

Every endpoint requires HMAC_SHA256(secret, timestamp + "." + body). Replies are idempotent on X-RRX-Idempotency-Key.

# 2. Record the player's bet against the committed round
TS=$(date +%s)
BODY='{"round_id":"<round_id>","player_id":"player_8f3a1c","rocket":"blue","amount":5.00,"currency":"USDC","bet_txn_id":"tx_998"}'
SIG=$(printf "%s.%s" "$TS" "$BODY" | openssl dgst -sha256 -hmac "<YOUR_HMAC_SECRET>" -hex | sed 's/^.* //')

curl -X POST https://rocketrushx.app/api/public/wallet/bet \
  -H "X-RRX-Operator: <slug>" \
  -H "X-RRX-Timestamp: $TS" \
  -H "X-RRX-Signature: $SIG" \
  -H "X-RRX-Idempotency-Key: bet_<round>_<player>" \
  -H "Content-Type: application/json" \
  -d "$BODY"

# 3. Settle the bet. Server compares cashout_at to its sealed crash multiplier.
TS=$(date +%s)
BODY='{"bet_id":"<bet_id>","cashout_at":2.40}'   # or null = let it ride to crash
SIG=$(printf "%s.%s" "$TS" "$BODY" | openssl dgst -sha256 -hmac "<YOUR_HMAC_SECRET>" -hex | sed 's/^.* //')

curl -X POST https://rocketrushx.app/api/public/wallet/cashout \
  -H "X-RRX-Operator: <slug>" \
  -H "X-RRX-Timestamp: $TS" \
  -H "X-RRX-Signature: $SIG" \
  -H "X-RRX-Idempotency-Key: cashout_<bet_id>" \
  -H "Content-Type: application/json" \
  -d "$BODY"

# → { "bet_id": "...", "status": "won"|"lost", "crash_at": 3.87,
#     "cashout_at": 2.40, "payout": 12.00 }

# 4. Anyone can audit the round once it's settled — no auth required.
curl https://rocketrushx.app/api/public/wallet/round/<round_id>

4. Provably-fair audit

Every round commits a SHA-256 of the server seed BEFORE the player picks a rocket. Crash points are derived from HMAC_SHA256(server_seed, "<client_seed>:<nonce>:<rocket>") with a published 3% house edge. After settlement the raw seed is exposed at /verify. The math, RNG specification, and house-edge formula live at /provably-fair.