Going to Production

Use this checklist to ensure your integration is production-ready before going live.

Pre-Launch Checklist

Authentication & SSO

• [ ] SSO token creation and exchange working end-to-end
• [ ] HMAC request signing implemented and verified
• [ ] Token error handling tested (expired, already-used, invalid)
• [ ] Production API keys obtained (sk_production_* prefix)

Game Integration

• [ ] Game iframe loads and plays correctly on desktop and mobile
• [ ] All postMessage events handled (game:exitRequest, game:balanceUpdate, etc.)
• [ ] At least one complete game round played in sandbox for each game
• [ ] Demo mode tested and working
• [ ] All game RTP variants reviewed and selected

Webhooks

• [ ] Webhook endpoint configured in operator dashboard
• [ ] Webhook signature verification implemented (SDK or manual)
• [ ] HTTPS webhook endpoint (required — HTTP not accepted)
• [ ] Idempotent webhook processing (deduplication by event id)
• [ ] Error handling tested (4xx/5xx responses)
• [ ] Retry handling verified (endpoint returns 2xx within 10 seconds)

Security

• [ ] IP whitelist configured (recommended)
• [ ] API keys stored securely (environment variables, not source code)
• [ ] Webhook secret stored securely
• [ ] CSP headers validated (your domain in frame-ancestors)

Responsible Gaming

• [ ] Responsible gaming limits configured for your jurisdiction
• [ ] Reality check flow tested and UI implemented
• [ ] Session expiry flow tested
• [ ] Self-exclusion handling implemented

Provably Fair

• [ ] Provably fair verification page linked in your platform
• [ ] Seed rotation tested
• [ ] Verification algorithm validated against test vectors

Crypto Wallets (if applicable)

• [ ] Deposit flow tested end-to-end
• [ ] Withdrawal flow tested end-to-end
• [ ] Withdrawal address whitelisting configured
• [ ] Balance reconciliation verified

Environment Differences

Setting	Sandbox	Production
API Key Prefix	sk_sandbox_	sk_production_
Base URL	https://api.slottylabs.com (environment derived from your API key)	https://api.slottylabs.com
Game URL	https://games.slottylabs.com	https://games.slottylabs.com
Real Money	❌	✅
Forced Outcomes (client.test.*)	✅	❌ (rejected with error 80060)
Webhooks	Sandbox events only	Production events

One API host

Both environments use the same base URLs — the platform derives the environment (sandbox vs production) from your API key. There is no separate sandbox hostname to configure.

Requesting Production Access

1. Complete all checklist items above — your progress is tracked as onboarding steps 1–6, visible via GET /api/v1/onboarding/status (authenticated with your API key) or in your dashboard
2. When every step is complete, request promotion: POST /api/v1/onboarding/promote. If any step is incomplete the call returns 422 with the list of failed checks
3. The Slotty Labs team reviews your integration (typically 1-2 business days) and issues your production API key (sk_production_…) via a secure channel
4. Swap the API key in your backend configuration — no other code changes are needed

Contact office@slottylabs.com if you need assistance during the review process.

Post-Launch Monitoring

After going live, monitor these metrics:

• Webhook delivery rate — Should be >99.5% first-attempt success
• API error rate — Should be <0.1% for non-4xx errors
• Game launch success rate — Should be >99%
• Average round duration — Baseline varies by game type
• Player session duration — Watch for responsible gaming compliance