# Quickstart

> From nothing to a playable sandbox session in six steps.

Source: https://casinoapipro.com/docs/quickstart
This walks from nothing to a playable game session in the sandbox. Everything here uses play money — no licence is required to complete it, and no real balance can move.

## 1. Get credentials

Ask us for a sandbox account at [casinoapipro.com](/#contact). You will get a dashboard login; create a credential pair there. The secret is shown once — store it in your secret manager before closing the dialog.

_credential (example)_

```json
{
  "api_key": "ck_test_7f3c9a21",
  "api_secret": "cs_test_9d41…shown once"
}
```

## 2. Exchange them for a token

Credentials are long-lived; access tokens are not. Exchange the pair for a bearer token and cache it until it expires.

_cURL_

```bash
curl -X POST https://api.casinoapipro.com/v1/auth/token \\
  -H "Content-Type: application/json" \\
  -d '{
    "api_key": "ck_test_7f3c9a21",
    "api_secret": "cs_test_9d41"
  }'
```

_JavaScript_

```js
const res = await fetch("https://api.casinoapipro.com/v1/auth/token", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ api_key: API_KEY, api_secret: API_SECRET }),
});

const { access_token, expires_in } = await res.json();
```

_PHP_

```php
$ch = curl_init("https://api.casinoapipro.com/v1/auth/token");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Content-Type: application/json"],
  CURLOPT_POSTFIELDS => json_encode([
    "api_key" => $apiKey,
    "api_secret" => $apiSecret,
  ]),
]);

$token = json_decode(curl_exec($ch), true)["access_token"];
```

## 3. List the games you can launch

```bash
curl https://api.casinoapipro.com/v1/games \\
  -H "Authorization: Bearer $ACCESS_TOKEN"
```

The response contains only games enabled for _your_ operator account, with your per-game stake limits already applied.

## 4. Point us at a wallet

Before a session can be created, we need somewhere to send debits and credits. In the sandbox you can skip writing one: create a sandbox player from the dashboard and we will use the built-in play-money wallet, which honours the same idempotency contract as a real one.

> **Test your retries properly**
>
> The sandbox wallet is not a stub that always says yes. It enforces balances, rejects duplicate `transaction_id`s the way production does, and can be told to fail, so your retry path is genuinely exercised before it matters.

## 5. Create a session

_cURL_

```bash
curl -X POST https://api.casinoapipro.com/v1/sessions \\
  -H "Authorization: Bearer $ACCESS_TOKEN" \\
  -H "Content-Type: application/json" \\
  -d '{
    "game_id": "mines",
    "player_id": "your_player_42",
    "currency": "GHS"
  }'
```

_JavaScript_

```js
const session = await api("/v1/sessions", {
  game_id: "mines",
  player_id: "your_player_42",
  currency: "GHS",
});

// Open this in the player's browser. Nothing else is needed.
redirect(session.launch_url);
```

```json
{
  "session_id": "sess_kgv5ws4duteqwhvjobok",
  "launch_url": "https://games.casinoapipro.com/play?token=eyJhbGciOi…",
  "expires_at": "2026-08-29T19:11:56.237Z",
  "game": { "id": "d533d22e…", "slug": "mines", "name": "Mines" },
  "player_id": "your_player_42",
  "currency": "GHS"
}
```

## 6. Open the launch URL

Redirect the player, or drop it into an `<iframe>`. The token in the URL is scoped to one operator, one player and one game, and it is short-lived — mint a fresh session per launch rather than storing the URL.

## What to build next

- [Wallet integration](/docs/wallet) — the five calls that move money.
- [Idempotency](/docs/idempotency) — read before you write retry logic.
- [Webhooks](/docs/webhooks) — round and transaction events, signed.