Live sport.
A connected wallet.

Prepare the 1X Sportsbook connection

Activate this product for your merchant account. Register your public outbound server IP, exact player-site hostname, HTTPS lobby URL, wallet callback URL and currency. Keep production credentials separate from test credentials.

1. Authenticate players in your website before requesting a launch.
2. Send the private API key from your backend. The domain header identifies the approved player website; it does not replace source-IP checks.
3. Use an HTTPS callback on an approved public hostname with a valid certificate and no redirect.
4. Store a stable player reference and an exact-decimal wallet ledger.
5. Check service status and merchant wallet stock before production activation. The merchant service wallet and each player's spendable wallet are separate balances.

Create a 1X launch ticket

curl --request POST 'https://1x.betapidata.online/api/v1/launch' \
  --header "Content-Type: application/json" \
  --header "X-Merchant-ID: $ONE_X_MERCHANT_ID" \
  --header "X-API-Key: $ONE_X_API_KEY" \
  --header "X-Merchant-Domain: merchant.example" \
  --data '{"playerId":"123456","username":"123456","currency":"BDT"}'

{
  "ok": true,
  "data": {
    "launchUrl": "https://1x.betapidata.online/launch?ticket=ONE_TIME_TICKET",
    "expiresIn": 60,
    "currency": "BDT",
    "mode": "production"
  }
}

Check ok === true and read data.launchUrl. This differs from the Exchange launch_url and Casino game_url response shapes. Consume the ticket once within 60 seconds.

Embed the sportsbook

<iframe
  title="Sports"
  src="LAUNCH_URL_RETURNED_BY_YOUR_BACKEND"
  allow="autoplay; fullscreen"
  referrerpolicy="no-referrer"
  style="width:100%;height:100dvh;border:0"
></iframe>

Set the iframe source to the returned data.launchUrl. The launch ticket is consumed and removed from the address by an in-frame redirect. The iframe manages JWT access, secure session/device cookies, CSRF and its live connection.

Sessions last up to eight hours. Consuming a replacement launch revokes the previous session for the same merchant and player. On expiration, create another launch from your authenticated backend. Third-party cookie/storage settings can affect embedded sessions; include those browsers in your acceptance tests.

The mobile header displays menu, logo, balance and My Bets. Logo navigation resets to the iframe's live root; its lobby control uses your configured lobby URL. Live/Sports navigation remains inside the iframe.

The isolated preview at 1xtest.betapidata.online uses a separate test wallet. Production play uses your signed merchant callbacks.

Implement the 1X wallet contract

Content-Type: application/json
X-1X-Merchant: YOUR_1X_MERCHANT_CODE
X-1X-Timestamp: UNIX_SECONDS
X-1X-Signature: LOWERCASE_HEX_HMAC_SHA256
Idempotency-Key: SAME_AS_TRANSACTION_ID

{
  "action": "balance",
  "transaction_id": "balance_EXAMPLE_REFERENCE",
  "player_id": "123456",
  "currency": "BDT"
}

{
  "status": true,
  "transaction_id": "balance_EXAMPLE_REFERENCE",
  "balance": 1000.0
}

{
  "action": "bet",
  "transaction_id": "1x_bet_42",
  "player_id": "123456",
  "bet_id": "42",
  "event_id": "EXAMPLE_GROUP_EVENT",
  "parent_event_id": "EXAMPLE_PARENT_EVENT",
  "market_id": "1",
  "selection_id": "2",
  "currency": "BDT",
  "amount": 100.0,
  "odds": 1.9
}

{
  "status": true,
  "transaction_id": "1x_bet_42",
  "balance": 900.0
}

{
  "action": "settlement",
  "transaction_id": "1x_settlement_42",
  "player_id": "123456",
  "bet_id": "42",
  "event_id": "EXAMPLE_GROUP_EVENT",
  "parent_event_id": "EXAMPLE_PARENT_EVENT",
  "currency": "BDT",
  "amount": 190.0,
  "result": "won",
  "odds": 1.9
}

{
  "status": true,
  "transaction_id": "1x_settlement_42",
  "balance": 1090.0
}

Verify 1X signatures

Use the dedicated 1X callback secret. The signed message is X-1X-Timestamp + "." + raw_request_body, signed with HMAC-SHA256 and encoded as lowercase hexadecimal. The merchant header must match your 1X account.

<?php
$raw = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_1X_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_1X_SIGNATURE'] ?? '';
$secret = getenv('ONE_X_CALLBACK_SECRET') ?: '';
if (!is_string($raw) || strlen($raw) > 65536 || $secret === ''
    || !ctype_digit($timestamp) || abs(time() - (int)$timestamp) > 300
    || !preg_match('/^[a-f0-9]{64}$/D', $signature)) {
    http_response_code(401);
    exit;
}
$merchant = $_SERVER['HTTP_X_1X_MERCHANT'] ?? '';
$expectedMerchant = getenv('ONE_X_MERCHANT_ID') ?: '';
if ($expectedMerchant === '' || !hash_equals($expectedMerchant, $merchant)) {
    http_response_code(401);
    exit;
}

$key = $secret;
$expected = hash_hmac('sha256', $timestamp . "." . $raw, $key);
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}
$event = json_decode($raw, true, 64, JSON_THROW_ON_ERROR);

After verification, validate the original player and currency. Keep one unique record per 1X merchant and transaction_id. Balance reads return a current read; financial retries replay their recorded outcome.

Live markets and odds preferences

The iframe groups markets under their returned groups, such as Main and Stats. Group event IDs and parent event IDs are retained separately. Your wallet handler should store both references and not substitute the parent ID for the betting group.

Browsing reads shared Redis snapshots and receives changed snapshots over the iframe's authenticated server event channel. Provider refreshes are shared by feed/event across viewers. Feed latency still depends on upstream availability and the configured key limits; a cached browse view is not a bet validation.

Every bet follows fresh server-side market and selection validation. A player can choose better odds only, any odds change, or explicit confirmation. The confirmed odds are the accepted bet odds. Unavailable, suspended or unacceptable changed prices do not become accepted money events.

Use the protected stream lookup

Call from your backend with the same 1X merchant authentication headers. A valid active player session and an available event assignment are required. Use the actual numeric 1X event ID and your original player reference.

curl 'https://1x.betapidata.online/api/v1/stream?eventId=767316350&playerId=123456' \
  --header "X-Merchant-ID: $ONE_X_MERCHANT_ID" \
  --header "X-API-Key: $ONE_X_API_KEY" \
  --header "X-Merchant-Domain: merchant.example"

{
  "ok": true,
  "data": {
    "eventId": "767316350",
    "available": true,
    "url": "https://cdn.betapidata.online/1x-media/OPAQUE_HANDLE"
  }
}

{
  "ok": true,
  "data": {
    "eventId": "767316350",
    "available": false
  }
}

Stream fields can include additional metadata. Always inspect available before reading url, and use only the returned protected link. Do not save expiring source URLs as permanent assets or trigger new launches just to refresh video.

Stream assignments and supported source matching are managed in Cloud. The iframe opens available video and otherwise displays available scores. Its media access is session-bound. Delivery depends on an unexpired playable stream and supported provider/browser framing policies.

Settle and retry exactly once

1. Verify the raw-body signature before decoding JSON or touching funds.
2. Validate merchant, original player reference, currency, event type and amounts.
3. Use a database transaction, lock the player wallet and record the callback outcome with the wallet movement.
4. Enforce a unique financial-event key for this product and merchant. Matching retries return the saved result without applying the amount again; conflicting reuse must be rejected.
5. Retain uncertain operations for reconciliation. A timeout, missing result in one fetch or an iframe error is not proof that an accepted bet failed.

Settlement uses the authoritative result source and accepted bet identifiers. Scores, event history or the TV result cannot settle a wallet. Winning payouts include stake; refunds return stake; a loss adds zero.

Uncertain callback deliveries are retained in a durable outbox and retried with the same transaction ID and financial payload. Record zero-value lost settlements too, and reject settlement for a bet without its confirmed matching debit. Operations staff can make an authorized declaration when needed; it follows the same settlement callback contract.

A test wallet and a production seamless wallet are distinct modes. Test funds are not converted into real player funds by changing a label. Complete production callback acceptance tests before enabling wagering.

Handle 1X errors

{
  "ok": false,
  "error": {
    "code": "merchant_unauthorized",
    "message": "Merchant authentication failed."
  }
}

Use the safe error message in the response and retain its code for diagnostics. Keep API keys, callback secrets, JWTs and media links out of analytics and public error output.

Verify your 1X integration