Skip to content
OrbiSportbook Docs

Overview

OrbiSportbook provides the sportsbook through an iframe embedded in your casino. We run odds, markets, bet acceptance, settlement and cash-out, and connect to your existing wallet through signed server-to-server calls.

Your platform is responsible for player registration, login, CPF validation, KYC and the cashier, including deposits and withdrawals. Your players keep their accounts and balance on your platform; they do not register again with OrbiSportbook.

OrbiSportbook URLs

Section titled “OrbiSportbook URLs”
Resource URL
Integration API https://api.orbisportbook.com/api/v1
Sportsbook and iframe origin https://api.orbisportbook.com
Embed SDK https://api.orbisportbook.com/embed/v1.js
Integration documentation api.orbisportbook.com/docs
Marketing site and theme gallery orbisportbook.com

The hosted environment currently runs in staging. Obtain your tenant ID and integration key from OrbiSportbook, and register your site’s allowed origins and wallet endpoint before integrating. Local development credentials shown in the quick start apply only to the local environment.

Who is responsible for what?

Section titled “Who is responsible for what?”
Area Client platform OrbiSportbook
Player accounts Registration, login, authentication and account management. Links an internal sportsbook record to your externalPlayerId and issues iframe sessions.
Identity Collecting and validating CPF, KYC, age checks and player eligibility. Receives the authenticated player reference from your server; does not provide the client’s onboarding or KYC service.
Cashier and funds Deposits, withdrawals, payment providers and the player’s wallet balance. Calls your balance, debit, credit and rollback endpoints for sportsbook activity.
Sportsbook Hosts the iframe in your casino and chooses theme, margins and betting limits. Odds, markets, bet slip, bet acceptance, settlement, cash-out and sportsbook back office.

A wallet credit is a sportsbook settlement movement, not a withdrawal to a bank account. The iframe’s Deposit button requests your cashier; it does not process a deposit itself.

Sessions identify players by your platform’s externalPlayerId, including for the BR profile. Do not send CPF. See the session contract.

How it works

Section titled “How it works”
  1. Login. The player logs in on your site. Your server calls POST /api/v1/integration/sessions with your API key and gets back a launch token: single use, valid for 120 seconds.
  2. Launch. Your page mounts the sportsbook with the embed SDK and the launch token. The iframe exchanges it once for a session token that only lives inside the iframe, so long-lived tokens never appear in URLs, logs or Referer headers.
  3. Bet. When the player bets, we call POST {your walletUrl}/debit, signed with HMAC-SHA256. You answer with the new balance, or insufficient_funds.
  4. Settlement. When the market is resulted we call credit: the payout for a winning bet, the stake for a void bet, and a zero-amount credit for a lost bet, so every bet is closed in your books.
  5. Events. The iframe tells your page what happens through postMessage: balance_changed, bet_placed, bet_settled, login_required, deposit_requested and more, so your header and cashier stay in sync.
Integration sequenceThe operator's server creates the session with its API key and gives the page a launch token; the iframe exchanges it for a session; every bet debits the operator wallet and every settlement credits it, with a zero amount for lost bets.Operator pageplayer's browserOperator serveryour backendSportsbook iframeour originSportsbook APIserver to serverOperator walletyour /wallet endpoints1 Loginplayer logs in on your sitePOST /integration/sessions (X-API-Key)launchToken (single use, 120 s)launchToken2 Launch the iframemount({ launchToken }) or set_launch_tokenPOST /integration/launchsession token (memory only)ready · balance_changed3 BetPOST /betsPOST /debit kind=bet (HMAC){ txId, balance }bet accepted + balance pushbet_placed · balance_changed4 SettlementPOST /credit kind=payout (0 if lost){ txId, balance }push: bet settled, balancebet_settled · balance_changedHTTPS requestresponsepostMessage (SDK)signed wallet call
The operator's server creates the session with its API key and gives the page a launch token; the iframe exchanges it for a session; every bet debits the operator wallet and every settlement credits it, with a zero amount for lost bets.

What you build

Section titled “What you build”

In the back office

Allow your site’s origins to frame the sportsbook and set your theme (Embedding, Theming).

Conventions

Section titled “Conventions”
  • One origin serves the sportsbook (/), the API (/api/v1), the embed SDK (/embed/v1.js) and these docs (/docs/). Your account manager gives you the sandbox and production origins; locally it is http://localhost:8080.
  • JSON in and out. Every API call names the tenant with X-Tenant-ID.
  • Money is an integer number of minor units (cents): 1050 is $10.50 or R$ 10,50. Never floats.
  • Errors are {"error": {"code": "...", "message": "...", "details": {...}}}. Branch on code (and details.reason), never on message.
Integrate with AI agentsGive your agent the contracts, implementation roadmap and acceptance criteria.
Quick startRun the sandbox and the reference operator, and see a bet hit your wallet.
PlaygroundMount the sandbox sportsbook and watch every event.

Aggregators and provisioning

Section titled “Aggregators and provisioning”

Automate client registration and activation from the aggregator backend.