Setup & provisioning
Before you can mint a session, your operator needs a handful of things in place. This is a one-time checklist; the pages in this section cover each in depth.
Checklist
- API keys & secrets — an inbound key to sign your S2S calls, the outbound secret LootBox Solutions uses to sign wallet calls to you, and one signing secret per webhook endpoint.
- Operator configuration — your wallet URL, webhook endpoints, enabled games, supported currencies and locales.
- Security & branding — the origins allowed to embed the iframe (CSP), and your brand colors / theme tokens.
What lives where
| Setting | Set in | Notes |
|---|---|---|
| API keys | Integration → API keys | Secret shown once at creation. |
| Outbound secret | Integration → Settings | HMAC secret for wallet calls to you. Encrypted at rest. |
| Wallet URL | Integration → Settings | Empty disables spending. |
| Webhook endpoints | Integration → Webhooks | Each endpoint has its URL, the events it receives and its own signing secret. |
| Allowed origins (CSP) | Integration → Settings | Until set, browsers refuse to embed. |
| Enabled games | Set by LootBox Solutions | mystery_box, upgrader. Ask us to enable or disable a game. |
| Upgrader settings | Settings → Upgrader | Win chances, house edge, wager limits, modes. |
| Currencies | Settings → Fx | Your pricing currency and the currencies players may switch to. See Localization & currency. |
| Locales | Languages | See Localization & currency. |
| Brand color / theme | Settings → Branding | Applied to the game app. |
Once these are in place, follow the Quickstart.