Аутентификация и подпись

POST
/api/v1/operator/players?source=web
1760520600
{"username":"jane_doe",…}

API_KEY="kx_live_your_key_id"
API_SECRET="kxs_your_secret"
URI="/api/v1/operator/players"
BODY='{"username":"jane_doe","email":"jane@example.com","first_name":"Jane","last_name":"Doe","birth_date":"1990-04-12","country":"MT","terms_accepted":true}'
TS=$(date +%s)

# METHOD \n REQUEST_URI \n TIMESTAMP \n BODY  →  hex HMAC-SHA256 with your secret
SIG=$(printf '%s\n%s\n%s\n%s' "POST" "$URI" "$TS" "$BODY" \
  | openssl dgst -sha256 -hmac "$API_SECRET" -hex | sed 's/^.* //')

curl -sS -X POST "https://kinetx.amhtechnologies.com$URI" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Timestamp: $TS" \
  -H "X-Signature: $SIG" \
  -H "Idempotency-Key: $(uuidgen)" \
  --data "$BODY"

<?php

function kinetx(string $method, string $uri, ?array $payload = null, ?string $idempotencyKey = null): array
{
    $apiKey = getenv('KINETX_API_KEY');      // kx_live_…
    $secret = getenv('KINETX_API_SECRET');   // kxs_…
    $body = $payload === null ? '' : json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    $timestamp = (string) time();
    $signature = hash_hmac('sha256', strtoupper($method)."\n{$uri}\n{$timestamp}\n{$body}", $secret);

    $headers = [
        'Accept: application/json',
        'Content-Type: application/json',
        "X-Api-Key: {$apiKey}",
        "X-Timestamp: {$timestamp}",
        "X-Signature: {$signature}",
    ];

    if ($idempotencyKey !== null) {
        $headers[] = "Idempotency-Key: {$idempotencyKey}";
    }

    $curl = curl_init('https://kinetx.amhtechnologies.com'.$uri);
    curl_setopt_array($curl, [
        CURLOPT_CUSTOMREQUEST => strtoupper($method),
        CURLOPT_POSTFIELDS => $body === '' ? null : $body,
        CURLOPT_HTTPHEADER => $headers,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 15,
    ]);
    $response = json_decode((string) curl_exec($curl), true);
    $status = curl_getinfo($curl, CURLINFO_RESPONSE_CODE);
    curl_close($curl);

    if ($status >= 400) {
        throw new RuntimeException("{$response['error']['code']}: {$response['error']['message']}", $status);
    }

    return $response;
}

$player = kinetx('POST', '/api/v1/operator/players', [
    'username' => 'jane_doe',
    'email' => 'jane@example.com',
    'first_name' => 'Jane',
    'last_name' => 'Doe',
    'birth_date' => '1990-04-12',
    'country' => 'MT',
    'terms_accepted' => true,
], idempotencyKey: bin2hex(random_bytes(16)))['data'];

$wallet = kinetx('GET', "/api/v1/operator/players/{$player['id']}/wallet")['data'];

import crypto from 'node:crypto';

const HOST = 'https://kinetx.amhtechnologies.com';

export async function kinetx(method, uri, payload, idempotencyKey) {
  const body = payload === undefined ? '' : JSON.stringify(payload);
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const signature = crypto
    .createHmac('sha256', process.env.KINETX_API_SECRET)
    .update(`${method.toUpperCase()}\n${uri}\n${timestamp}\n${body}`)
    .digest('hex');

  const response = await fetch(HOST + uri, {
    method,
    headers: {
      Accept: 'application/json',
      'Content-Type': 'application/json',
      'X-Api-Key': process.env.KINETX_API_KEY,
      'X-Timestamp': timestamp,
      'X-Signature': signature,
      ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {}),
    },
    body: body === '' ? undefined : body,
  });

  const json = await response.json();
  if (!response.ok) throw Object.assign(new Error(json.error.message), json.error);
  return json;
}

const { data: player } = await kinetx('POST', '/api/v1/operator/players', {
  username: 'jane_doe',
  email: 'jane@example.com',
  first_name: 'Jane',
  last_name: 'Doe',
  birth_date: '1990-04-12',
  country: 'MT',
  terms_accepted: true,
}, crypto.randomUUID());

// Your server: POST /api/v1/operator/players/1042/session-tokens  →  { data: { token, expires_at } }
// Your front end (never holds the API secret):
const res = await fetch('https://kinetx.amhtechnologies.com/api/v1/player/games/311/launch', {
  method: 'POST',
  headers: { Authorization: `Bearer ${playerToken}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({ mode: 'real', platform: 'mobile' }),
});
const { data } = await res.json();
window.location.href = data.launch_url;