Integrate in about a day

How it fits together

Your game platform --rounds--> Your backend --(API key)--> SlotClarity API --> Console (your staff)
                                   |                          ^
Player browser --(your session)----+   widget / iframe -------+ (short-lived player token)

Your API key stays on your servers. Browsers only hold a player token that expires in at most an hour.

1. Send rounds (events API)

POST /v1/events with Authorization: Bearer <API key>, up to 5,000 rounds per request. Re-sending a round is ignored, so retries are safe. Invalid rounds are reported individually and never block valid ones.

{ "events": [ {
  "roundId": "r-8812731", "playerRef": "a1f9c3", "gameId": "pharaohs-vault",
  "ts": 1760900000000, "currency": "EUR", "bet": 100, "win": 250,
  "phase": "base", "bonusTriggered": false
} ] }

playerRef must be pseudonymous: never names, emails or account numbers. Amounts are integers in minor units. Late and out-of-order rounds are handled and sessions are rebuilt correctly. History can be backfilled with POST /v1/events/csv, and the game catalog uploaded with POST /v1/games/csv.

2. Webhook adapter for existing round feeds

Already have a round webhook? Point it at POST /v1/webhooks/rounds. Common field names such as transaction_id, player_id, game_code, stake and payout, decimal amounts, and second or ISO timestamps are mapped automatically. Add ?amounts=minor or ?currency=EUR when needed. Platform-specific adapters are on request.

3. Token endpoint

From your backend, when a logged-in player opens their account, and exposed through your own authenticated route:

POST /v1/player-tokens
Authorization: Bearer <API key>

{ "playerRef": "a1f9c3", "ttlSec": 900 }
-> { "token": "...", "expiresIn": 900 }

4. Embed

Web component

<script type="module" src="https://api.slotclarity.com/static/slot-clarity.js"></script>
<slot-clarity api="https://api.slotclarity.com" token-url="/account/slotclarity-token" lang="fr"></slot-clarity>

Attributes: lang (en, fr, es, de, nl), theme, period, tab. Branding uses CSS variables such as --sl-accent and --sl-bg.

Hosted iframe (no front-end build)

<iframe id="slotclarity" title="My slot stats" style="width:100%;border:0"
  src="https://api.slotclarity.com/embed#token=TOKEN&ttl=900&lang=fr&theme=dark"></iframe>
<script src="https://api.slotclarity.com/static/parent.js"
  data-token-url="/account/slotclarity-token" data-frame="slotclarity"></script>

The token travels in the URL fragment, which is never sent to servers or logs. Native apps can load the same URL in a WebView.

Reality-check bar

<slot-clarity-reality-check api="https://api.slotclarity.com" token-url="/account/slotclarity-token" interval="30"></slot-clarity-reality-check>

Events you can listen for to pause the game: slotclarity:reality-check, slotclarity:continue, slotclarity:break, slotclarity:open-stats.

5. Webhooks and CSV

Set an https URL in the console. Events include player.break_requested, rg.markers, integrity.deviation, session.ended (opt-in), feed.stalled and feed.recovered. Failed deliveries are retried and logged. Each request carries x-slotclarity-signature: t=<unix seconds>,v1=<hex> where v1 is an HMAC-SHA256 of <t>.<raw body>; reject anything older than five minutes.

import { SlotClarity } from '@slotclarity/sdk-node';
const event = SlotClarity.verifyWebhook(rawBody,
  req.headers['x-slotclarity-signature'], process.env.SLOTCLARITY_WEBHOOK_SECRET);

Players can export their own rounds as CSV from the panel, and your compliance team can download the impact report as CSV from the console. A Node.js SDK handles batching, retries and replay; verification examples for Python, PHP and Java are in the full guide.

Data checker

Paste a few of your own rounds into the checker in the free trial. It tells you exactly what would be accepted or rejected, and nothing is stored.

Keys and limits

• Scoped API keys: ingest, tokens, read, admin; named, revocable, with last-used time
• Rate limits per caller per minute: 6,000 ingest, 600 operator, 240 player requests; over the limit returns 429 with retry-after
• Every response carries x-request-id; errors return { error, requestId }
• GET /health for monitoring; Prometheus metrics behind a token