Need Help?
01 Sign in
MFA is a one-time code on the desk. House can require it per Client ID. The session stays on GameXora.
Home · Company · Trust
Keys on the desk. A trace on every hop
House can require MFA, HMAC, and an IP allow-list. Master supply keys stay house-side. Player chips stay on the operator wallet.
Three locks
Sign in, call, then settle
Each step has its own secret. A desk login is not a supply key, and a supply key is not a player wallet.
02 Call
The sell API takes X-Client-Id, X-Api-Key, and X-Api-Secret. HMAC and an IP allow-list are there when house turns them on.
03 Settle
Wallet callbacks carry a timestamp, nonce, and signature. The same transaction id does not settle twice.
On the desk
What house can turn on
These are desk controls. GameXora does not run KYC or AML on this page.
Desk MFA
Optional until house requires it. One code per sign-in, on that Client ID.
Sessions
A signed-in desk stays on GameXora. The session is not sent to a studio.
Key and secret
Issued with the Client ID. They launch only the titles assigned to that desk.
HMAC
House can require a signature on the sell API so a copied header is not enough.
IP allow-list
Calls from outside the list do not start a game. House can narrow it without a new key.
Supply keys
Master credentials stay on the house side. They never appear on the agent books.
When a call fails
Quote the traceId
Every sell-API reply and wallet callback carries one trace. That is how house follows desk, GameXora, and supply on the same hop.
Write support@gamexora.com with the Client ID, the time, and the traceId. A limit answers CREDIT_LIMIT or WALLET_LIMIT. It does not silently overdraw.
Questions
What this page does not do
Does GameXora hold player balances?
No. Bet and win settle on the operator wallet through callbacks. Chargeable GGR is the only figure written to the commercial ledger.
Can house force MFA?
Yes. MFA can be required on a single Client ID. Until then it stays optional on that desk.
Where do master supply keys live?
With house. The agent desk receives its own API key and secret, and only the supply assigned to it.
What if the same callback arrives twice?
Settlement is idempotent by transaction id. A replay does not move the player wallet a second time.
Is this KYC or AML?
No. Trust here is sign-in, API keys, and a trace. GameXora does not screen players.
Need a desk reviewed?
House can require MFA, rotate keys, and tighten the IP allow-list. Write in with the Client ID.