Sending the token#
| Where | Format | When |
|---|
Header Authorization | Bearer {token} — capital B, one space | Every call except Demo Login, Languages and Ping |
Query token | ?token={token} | Only read when the header is absent. Use it for the room stream, because EventSource cannot send headers |
The token is an opaque 64-character hex string. Do not parse it.Session lifetime#
A session lives 12 hours from Start Game (or Demo Login).
Launching the game again for the same player (a new Start Game) ends the previous session — the old token then answers 10010.
A real player's session also ends when the player or the agent is suspended, or the agent's setup changes in the Backoffice.
A demo session is reused while it is alive: Demo Login with the same playerID returns the same token and keeps the balance.
When the session check fails#
| HTTP | code | Meaning | What the client should do |
|---|
| 401 | 99902 | Unauthorized. — no token was sent | Treat as a client bug; do not retry |
| 401 | 10010 | Session expired. Please login again. | Stop polling, tell the player the session ended, offer the reurl link |
These two answers carry no validationError key.Modified at 2026-09-30 13:23:45
