One integration.
Every game.

Start in three steps

Try the Example Website

Open partner sandbox → Transfer In → Play → browser Back → Transfer Out → Reconcile. It uses a signed browser identity and test funds, not production customer authentication. New game wallets start at zero; the example website starts with 1,000 DEMO credits.

Authenticate every request

All provider operations use POST and a JSON object. Send these four headers from the website backend.

Canonical signing string

Join these five lines with LF characters. No trailing newline. Use the exact UTF-8 secret string as the HMAC key; do not hex-decode or base64-decode it.

POST
/provider/v1/games
<TIMESTAMP_MILLISECONDS>
<UNIQUE_NONCE>
<EXACT_RAW_JSON_BODY>

The final line is the raw JSON body, not its SHA-256 hash. These rules are specific to NewWorld; other providers' signatures are not interchangeable.

Website scope is derived from the key. Disabled websites, revoked keys and unauthorized game assignments are rejected. Key revocation also invalidates bound sessions and unused launch tickets.

Backend code examples

Credentials below are environment variables, never actual keys. These examples request the game catalog.

import { createHmac, randomUUID } from 'node:crypto';
const base = process.env.NW_BASE_URL || 'https://api.nw0007.com';
const path = '/provider/v1/games';
const raw = JSON.stringify({});
const timestamp = String(Date.now());
const nonce = randomUUID();
const canonical = ['POST', path, timestamp, nonce, raw].join('\n');
const signature = createHmac('sha256', process.env.NW_SECRET)
  .update(canonical).digest('hex');
const response = await fetch(base + path, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-NW-Key-Id': process.env.NW_KEY_ID,
    'X-NW-Timestamp': timestamp,
    'X-NW-Nonce': nonce,
    'X-NW-Signature': signature
  },
  body: raw,
  signal: AbortSignal.timeout(10000)
});
const result = await response.json();
if (!response.ok) throw new Error(result.error);
console.log(result);

<?php
$base = getenv('NW_BASE_URL') ?: 'https://api.nw0007.com';
$path = '/provider/v1/games';
$raw = '{}';
$timestamp = (string)(int)floor(microtime(true) * 1000);
$nonce = bin2hex(random_bytes(16));
$canonical = implode("\n", ['POST', $path, $timestamp, $nonce, $raw]);
$signature = hash_hmac('sha256', $canonical, getenv('NW_SECRET'));
$ch = curl_init($base . $path);
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_POSTFIELDS => $raw,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_TIMEOUT => 10,
  CURLOPT_HTTPHEADER => [
    'Content-Type: application/json',
    'X-NW-Key-Id: ' . getenv('NW_KEY_ID'),
    'X-NW-Timestamp: ' . $timestamp,
    'X-NW-Nonce: ' . $nonce,
    'X-NW-Signature: ' . $signature
  ]
]);
$result = curl_exec($ch);
if ($result === false) throw new Exception(curl_error($ch));
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($status !== 200) throw new Exception($result);
echo $result;

import os, time, uuid, hmac, hashlib, json
import urllib.request
base = os.getenv('NW_BASE_URL', 'https://api.nw0007.com')
path = '/provider/v1/games'
raw = json.dumps({}, separators=(',', ':'))
timestamp = str(time.time_ns() // 1_000_000)
nonce = str(uuid.uuid4())
canonical = '\n'.join(['POST', path, timestamp, nonce, raw])
signature = hmac.new(os.environ['NW_SECRET'].encode(),
                     canonical.encode(), hashlib.sha256).hexdigest()
request = urllib.request.Request(base + path,
  data=raw.encode(), method='POST', headers={
    'Content-Type': 'application/json',
    'X-NW-Key-Id': os.environ['NW_KEY_ID'],
    'X-NW-Timestamp': timestamp,
    'X-NW-Nonce': nonce,
    'X-NW-Signature': signature
  })
with urllib.request.urlopen(request, timeout=10) as response:
    print(json.load(response))

Download reusable Node.js client ↗

Errors & recovery

Errors use an HTTP status and an error message. Symbolic error-code fields are not implemented.

{"error":"Request replayed"}

After an uncertain game response, keep the same round identity. NewWorld preserves pending intents and game outcomes; owner recovery is available in Backoffice. Do not retry a wager using a new round ID.

Transfer Wallet API

POST every operation to https://api.nw0007.com/provider/v1/ with the HMAC headers described above. Money is integer minor units: 100 = 1 DEMO. No real currency is supported.

Durable receipts & retries

Player creation is idempotent and starts at zero. Transfer IDs are 8–100 letters, digits, hyphens or underscores and unique within a website. Amount must be an integer from 1 to 1,000,000,000,000 minor units. Repeating the same transaction ID and payload returns the original receipt, without moving funds twice. Changing its amount, player or direction returns 409. Use a NEW authentication nonce and timestamp on every retry, but retain the ORIGINAL transaction ID.

A receipt has transactionId, playerId, currency, direction, amountMinor, status, balanceMinor, createdAt and optional reason. Status is completed or rejected. A rejected receipt is final; inspect its reason. On timeout, keep your website reservation pending, query transfer-status, then retry the original operation. A 404 status is not proof of failure: retry with the same transaction ID. Never refund solely because a response was lost.

Reserve website funds durably before Transfer In. Finalize that debit on completed; release only on confirmed rejected. For Transfer Out, credit the website once after a completed receipt. Store your own durable transfer journal. Pending game rounds block transfers with 409; unresolved Free Spins block Transfer Out. Retry after settlement/bonus completion.

Reconciliation

expectedMinor = openingMinor + transferInMinor − transferOutMinor − wagerMinor + payoutMinor. differenceMinor must be zero. pendingRound means settlement is still unresolved. Receipts report balance at that transfer, not the current balance; use balance/reconcile for current values.

Return to your website using browser Back in this sandbox. A configurable return_url is not implemented. Production wallet integration, operational review and real-money approval remain separate work.

Meet NewWorld

An orbital NW emblem with an indigo-to-cyan palette, paired with a clear silver wordmark. Designed for dark website lobbies and developer interfaces.

Transparent PNG master. Keep the logo's proportions; use on dark backgrounds. No trademark registration or clearance is implied.