Iframe lobby

The iframe lobby is a ready-made casino lobby you put on your site with one tag. It shows a grid of games with search, studios and categories, and when a player clicks a game, it opens the game inside the lobby. You do not need to integrate the operator API to use it.

You only need the operator API and the seamless wallet when your players play for real money. Without them, the lobby still works in demo or play-money mode, so you can try it out first.

1. Create a lobby

In the portal, go to Iframe → Lobbies and press New lobby. Pick the brand and give the lobby a name. Then set these:

Setting	What it does
Guest mode	what a visitor without a player token gets: Demo (provider fun mode, only games with a demo are listed), Play money (play money on our side, never billed, never calls your wallet), Off (no play until the player signs in on your site)
Real money	when this is on, a visitor with a valid player token plays for real through your brand's wallet
Allowed sites	the sites allowed to show the lobby in an iframe, for example `https://www.mycasino.com`. If this list is empty, any site may show it. Fill it in before you go live.
Campaign tag	the default traffic tag for this lobby (see Campaigns)
Look	title, accent colour, background colour, grid or compact cards, and whether search, studios and categories are shown
Games	limit the lobby to some studios, categories or game ids. If you leave this empty, every game that is on in Game settings for the brand is listed.

Game switches, demo switches, bet limits and provider switches from Game settings apply to the lobby too.

2. Put it on your page

<iframe
  src="https://reelgate.code-matrix.tech/embed/rge_YOUR_LOBBY_KEY?player=PLAYER_TOKEN&campaign=CAMPAIGN"
  style="width:100%;height:820px;border:0"
  allow="autoplay; fullscreen; clipboard-write"
  allowfullscreen></iframe>

The URL takes these parameters, and all of them are optional:

Parameter	Meaning
`player`	a signed player token (step 3). Leave it out for guests.
`campaign`	a traffic tag for this visit, for example `fb-nov` or `google-brand`. Allowed characters are letters, digits, space, `_ . - :`, up to 100 characters.
`lang`	the game language, for example `en`, `pt`, `es`

3. Real money: the player token

When a player is signed in on your site, your backend builds a token and puts it into the iframe URL. Never build it in the browser, because it is signed with your brand's API secret.

token = base64url(JSON) + "." + hex( HMAC-SHA256( api_secret, base64url(JSON) ) )

base64url is without = padding. The JSON fields are:

Field	Required	Meaning
`player_id`	yes	your player id, the same one your wallet knows
`exp`	yes	unix time when the token expires, at most 24 hours ahead
`currency`	no	the player's currency. It must be one of the brand's currencies. The brand default is used when it is missing.
`nickname`	no	the name shown in the lobby
`country`	no	ISO country code

Node.js

const crypto = require('crypto');
const body = Buffer.from(JSON.stringify({ player_id: 'p-1001', currency: 'USD', exp: Math.floor(Date.now() / 1000) + 3600 })).toString('base64url');
const token = body + '.' + crypto.createHmac('sha256', process.env.REELGATE_API_SECRET).update(body).digest('hex');

PHP

$body = rtrim(strtr(base64_encode(json_encode(['player_id' => 'p-1001', 'currency' => 'USD', 'exp' => time() + 3600])), '+/', '-_'), '=');
$token = $body . '.' . hash_hmac('sha256', $body, getenv('REELGATE_API_SECRET'));

Python

import base64, hashlib, hmac, json, os, time
body = base64.urlsafe_b64encode(json.dumps({"player_id": "p-1001", "currency": "USD", "exp": int(time.time()) + 3600}).encode()).rstrip(b"=").decode()
token = body + "." + hmac.new(os.environ["REELGATE_API_SECRET"].encode(), body.encode(), hashlib.sha256).hexdigest()

Real-money play uses the same rules as the operator API. The brand must be active with KYB approved, there must be credit left, and the wallet URL must be set. Every bet and win calls your seamless wallet for that player_id.

To try real play without writing code, the owner can press Player token on a lobby. This gives a token for a test player id that works for up to 24 hours.

4. Talking to your page (optional)

The lobby sends postMessage events to your page:

`type`	When	Extra fields
`reelgate:ready`	the lobby has loaded	`total` (games), `player` (true when the token is valid)
`reelgate:launch`	a game opened	`game_id`, `game`, `mode`, `session`
`reelgate:close`	the player went back to the lobby	`session`
`reelgate:cashier`	the player pressed deposit inside a game
`reelgate:signin`	a guest clicked a game while guest mode is Off	`game_id`
`reelgate:resize`	the content height changed	`height`

Every event also carries lobby (the lobby key). Check event.origin === 'https://reelgate.code-matrix.tech' before you trust an event.

Your page can send these messages to the lobby:

frame.contentWindow.postMessage({ type: 'reelgate:player', token: newToken }, 'https://reelgate.code-matrix.tech'); // player signed in
frame.contentWindow.postMessage({ type: 'reelgate:close' }, 'https://reelgate.code-matrix.tech');                     // close the open game

5. Campaigns and promos

Every game session opened from a lobby, and every bet and win in it, is tagged with the lobby and the campaign tag. The tag comes from ?campaign= on the iframe URL, or from the lobby default when the URL has none. Free-spin wins also keep the promotion they came from.

Iframe → Reports shows the live GGR of lobby traffic, grouped by lobby, campaign tag, promotion, day, game or provider:

GGR is bets minus wins, minus promo wins, minus provider prizes, minus rollbacks, plus adjustments. These are the same numbers as Reports, limited to lobby traffic.
Promo wins are wins from free spins. GGR before promo adds them back, so you can see what a promotion cost you.
Include play money adds Demo and Play-money traffic. You can use it to check a new lobby before real players arrive. Play money is never billed.

The last 15 minutes are refreshed every 15 seconds.

Security

The lobby key is public: anyone who has it can open the lobby. Fill in Allowed sites, and press Rotate key if a key leaks. The old URL stops working at once.
The player token is the only way to play for real. Keep tokens short-lived, because a token that leaks lets someone play as that player until it expires.
Each network can create only a limited number of new guests per hour.