Changelog

Newest first. This documentation always describes the version in production.

Generator versions in production#

A change to what a generator draws, or how, is a new version: every round records the version that produced it. See Provably fair.

13 October 2026 — the player id has a shape, and three things a lobby could notice#

• player is printable ASCII without spaces. It always was in practice; it is now enforced: a launch or a promo opt-out with another character answers 400 on player, before any database query. The guide (§4) and the OpenAPI carry the rule.
• "Back to the lobby" navigates your page, not the iframe. The game navigates the top window to lobbyUrl (after posting exit on the bridge, as before); inside a sandboxed frame without allow-top-navigation it falls back to navigating the frame.
• Big Fish shows on the cash-out tile exactly what is paid. The animated figure now applies the same rounding and maxWin cap as the settlement; before, the tile could read one cent above the payout, and above the cap near it.
• Double tap on a button no longer zooms the page in God Candle, Diamond Hands and Hypnofrog (Big Fish already had it).
• You can end a player's sessions. POST /b2b/players/:player/sessions/revoke, signed like the reads: the open sockets close with 4401 and every token issued up to that instant is refused; a later launch works again. Guide §8d and the OpenAPI.
• A /balance that fails no longer shows a balance of 0. If your wallet does not answer 200 to the balance call made when the game opens, the session is refused (4004) and the game retries slowly, instead of opening with a figure that is false for a player with money on the account. The guide's wallet table (§6.1) says so.

12 October 2026 — sessions longer than an hour, and refunds after a crash on our side#

• A player connected for longer than an hour no longer loses the session on a reconnect. The game token was renewed only when the client connected, so a player who stayed connected past the token's one-hour lifetime held an expired token: if the connection then dropped — a mobile network, a backgrounded tab — the reconnect was refused and the player was sent back to your lobby. The server now renews the token while the player stays connected, at about half its lifetime. Nothing to change on your side; a suspended operator's sessions are still not renewed. See Session and token lifetime.
• Stakes left open by a crash of our server are refunded within minutes, as the integration guide states. Before this release, after a crash followed by a fast restart, the /rollback of those stakes could wait up to six hours, and beyond the first fifty a further five minutes for every fifty. The amounts were always right and the rollbacks always arrived. See How we read a /bet response.

9 October 2026 — Hypnofrog's multiplier on /win#

• Hypnofrog now sends the multiplier relative to entry on /win, as the integration guide has always stated and as God Candle and Diamond Hands do. Before this release, for a position opened while a Hypnofrog round was running, the field carried the ladder's absolute multiplier: a fly entered at 4.00x and cashed out at 8.00x arrived as 8.00 instead of 2.00. The amount was always right. If you rank players by max multiplier, Hypnofrog rows of GET /b2b/settlements created before this release may hold the absolute value. Positions opened before the launch were never affected: there the two numbers coincide. See the /win call.

9 October 2026 — the guided tour, switchable per room#

• The first-visit guided tour can be switched off for a room. The tour that lights up the screen for a player opening a game for the first time, and the short hints that follow it, are on by default; if your lobby has its own onboarding, we switch ours off for your rooms. The in-game ? stays either way: it is the help the player asks for. Like auto bet, the client reads the setting at every connection. See Per-operator configuration.

8 October 2026 — rooms played on several tables#

• A room can be played on several tables. A table is one running game with its own hash chain; in a room with tables the server seats each player at one, opens tables as players arrive and moves players between them between two rounds, never with a position open. Balance, responsible-gaming session, limits and leaderboard follow the player: they belong to the room. See Rooms and tables.
• Switched on room by room, with the operator's written agreement, because two things change on its side: the ids of rounds and bets carry the table (<room>--t<n> from table 2), and the exposure cap holds per table, so a room's worst case is the cap times its tables. A room without tables is one table, and nothing changes for it.
• GET /b2b/room/:id/status lists the tables of the room: tables and retiredTables, new in the OpenAPI.
• GET /fair?room= lists every table with its published chain end, its client seed and when it was created, in pages of 50 (tablesAfter, tablesNext): tables are created before they are needed and used in order, and the list shows it. See Provably fair.
• A new launch refusal, 503 ROOM_FULL with Retry-After: 20, when every table of a room is at its cap and no new one can open yet. New in the launch error enum of the OpenAPI.
• Nothing changes in the math or the generators.

6 October 2026 — a retried request gets the first answer#

• The same signed request twice is a retry, not a failure. Since 3 October a signature was good once, and the same signature again answered 401 REPLAY — even when it was your own proxy retrying the same bytes. Now, from the same IP address within two minutes, a retried POST /b2b/launch or promo opt-out gets the response we gave the first time — same status, same body, the same game token — with the header idempotent-replayed: true, and nothing runs again: no second session, no second audit row. A read is simply answered again.
• From another IP address it is still 401 REPLAY: a captured launch request sent again from elsewhere does not get the player's token.
• A retry that arrives while the first is still running waits for it, up to 15 seconds, then answers 409 REPLAY_IN_PROGRESS (new in the launch error enum of the OpenAPI).
• To try again after a refusal, sign a new request with a fresh x-timestamp, as before: the first answer, a 503 included, is the answer to that request. See the integration guide.

6 October 2026 — a filtered chat, and «BET» in operator builds#

• The room chat is filtered. The server masks profanity, insults and slurs in English, Spanish and Italian before any other player reads the message — the first letter stays, the rest becomes asterisks, and the message still goes through. It reads whole words, so ordinary words that contain one are left alone. It is a word filter, not moderation.
• A plain bet button. In operator builds the bet button of God Candle and Diamond Hands says «BET» («APOSTAR» in Spanish), and the live feed says «bet»: the crypto slang they used before is gone. The screenshots and clips of the media kit show the new button.
• Nothing changes in the math or the generators.

6 October 2026 — the integration guide, checked from the outside#

We ran the integration the way an outside integrator would: from this documentation alone, against a local server, without reading our code. It held end to end — launch, game, wallet callbacks, signed reads, round verification and reconciliation, with no mismatch. What it found unclear or wrong is fixed here.

• Signatures are single-use, and the guide now says so everywhere. One paragraph of §7b still said a read could be replayed within its 60 seconds; since 3 October the same signature twice answers 401 REPLAY. A signature is remembered as soon as it verifies, whatever the answer to it, a 503 included: re-sign every retry. REPLAY is now in the OpenAPI's launch error enum and in the 401 of every read.
• How a /win amount is computed (§6.2): stake × multiplier × f, floored and capped at the room's maxWin, where f is the room's RTP for a position opened mid-round in God Candle, Diamond Hands or Hypnofrog, and 1 otherwise. So amount is not always stake × multiplier.
• How a seed is hashed (Provably fair): SHA-256 and the HMAC key take the seed's 64-character hex text, not the bytes it spells; and the stream message carries a label.
• Wallet edge cases (§6.3, §6.5): the balance to answer for a /rollback of a betId you have never seen; what to do with a /win you did not debit; retry delays are minimums; what win.attempts and win.lastError count.
• Embedding (§5.1): origins are https only, tests included; and to relaunch, replace the iframe — a gameUrl that changes only after the # does not reload the game.
• Smaller corrections: the launch example no longer shows &lobby= (the lobby URL travels in the token since 3 October); God Candle's generator version in the catalog example is 0.2.0; an unencoded # in a betId answers 404 OPERATOR_UNKNOWN; the room status active and the values of a bet's timeline are defined; /fair positions carry the betId your wallet saw; the balance the game shows while a /win is retried; the timing of checklist test 9.
• One server fix: /b2b/bet/:id and the promo opt-out now take the full documented lengths, a betId up to 256 characters and a player up to 128, and answer the documented 400 beyond. Until now our HTTP layer refused any path segment over 100 characters with a 414 before the route; every betId we issue is shorter than that.

5 October 2026 — Hypnofrog: the frog's frenzy replaces the beam#

• The round now ends with the frog's frenzy. At the beat where the beam used to fire, the frog's eyes turn white and it opens its mouth wide. Thin currents of air swirl across the pond into it, and every fly still alive is caught: it shakes and turns to flee, then gets sucked in tail first, faster and faster, and vanishes into the mouth. The mouth closes on the last one and the eyes go back to the spiral.
• It is the same event, drawn the same way. Same beat, derived from the seed; same outcome: every open position loses. Only what the player sees has changed. The labels follow: the risk chip under the multiplier reads 🐸 instead of ⚡, and so do the next-beat sheet, the feed line, the round-end title and the list of revealed rounds in the fairness panel.
• No flashes and no shaking. Nothing lights up or strobes, and neither the arena nor the camera shakes any more. Without WebGL the flies are pulled towards the frog's place without the air currents, and with reduced motion they vanish where they are instead of travelling to the mouth.
• Nothing changes in the math or the integration: the RTP, the generator version (hf-0.1.0) and the round-end reason in the API — STOMPED, the event's original name — are the same.

5 October 2026 — room limits: the exposure cap covers one maximum stake#

• A room's maxExposure is never below the worst case of one maximum stake: min(maxBet × capMultiplier, maxWin), with the effective limits (yours from the registry included). Below that, the room refused its own maximum stake with EXPOSURE_CAP even at an empty table — with no max win, a 5,000 cap on a 1,000× game accepted no stake above 5. Such a configuration is now refused when a room is created or changed, and the refusal states the minimum and the two other ways out: a lower maximum stake, or a max win.
• It also applies when the binding cap is your registry limits.maxExposure: since a registry value can only tighten, the way out is then the room's maximum stake or its max win.
• Nothing changes for a stake inside the limits, nor in the math, the generators or the API.

4 October 2026 — Hypnofrog: the frog's beam replaces the foot#

• The round now ends with the frog's beam. At the beat where the foot used to come down, the frog opens its mouth and fires a cone of light across the pond, and a bolt hits every fly still alive. The pond dims while it fires, so the beam stands out; the flies stay bright, and the ones that are hit light up before they fall.
• It is the same event, drawn the same way. Same beat, derived from the seed; same outcome: every open position loses. Only what the player sees has changed. The labels follow: the risk chip under the multiplier reads ⚡ instead of 🦶, and so do the next-beat sheet, the feed line, the round-end title and the list of revealed rounds in the fairness panel.
• No strobing. The light ramps up and down once per round; only the thin bolts flicker. With reduced motion the bolts stand still and neither the arena nor the camera shakes.
• Nothing changes in the math or the integration: the RTP, the generator version (hf-0.1.0) and the round-end reason in the API — STOMPED, the event's original name — are the same.

3 October 2026 — Hypnofrog: slower beats at the start of the round#

• The first beats of a round last twice as long. The round opens at about 1.74 s per beat instead of 0.89 s, and the beats shorten faster than before: from about the 30th beat on they run as they did, down to 0.5 s. A position's three fly switches stay available for the first 12.3 s of the round instead of 6.7 s, and the last one until 28.5 s instead of 18 s — the time to see where the crowd is moving and to move with it, or away.
• Rounds are longer: 31.3 s median instead of 20.4 s, 39 s at most instead of 28 s.
• When the frog takes more than one fly in a beat, the tongues still leave one after the other, and each now has a slightly different shade of pink, so two strikes on screen at the same time can be told apart.
• Nothing changes in the math. The length of a beat is pacing only: the odds of every beat, the multiplier ladder, the RTP and the generator version (hf-0.1.0) are the same, and rounds already played are verified with the configuration recorded with them.
• No change to the integration: the game client reads the pace from the server, and the messages and what the server accepts do not change.

3 October 2026 — advanced features can be hidden, and settings on desktop#

• A switch in the settings hides the advanced features. «Advanced features · ON/OFF» in the ⚙ menu hides, in all four games, the auto bet chip and the ADVANCED BET cell under each stake column: the column becomes the stake button alone and the panel gets shorter. The choice is remembered by the browser and shared by the four games on the same origin; by default everything is shown.
• It is a real switch, and it locks on while something advanced is running. With an auto bet armed, a column's advanced orders armed, an open position or a queued bet carrying a take profit or stop loss, or a placed free bet (its maximum win is held as a take profit), the switch stays on, cannot be turned off, and a line under it says why: the chip is the only STOP of the automation, and the cell the only place that shows an open position's orders. The player's own choice is not changed by the lock: once the free bet or the orders are gone, the switch goes back to what the player had chosen. Showing the advanced features again is always allowed. An armed column now keeps them visible too, so the cells no longer reappear round after round with the switch saying off. Music, sound effects and voice in the same menu are switches of the same kind.
• In Hypnofrog the free bet enters a running round. Tapping the free bet while the round is live now places it at the current entry price on a live fly, as the ENTER AT button does and as the other three games already did; it is queued for the next round only between rounds, or when no fly is alive.
• The settings menu exists on desktop too. The ⚙ button now appears at every width and opens the same sheet as a side panel: music, sounds, voice, language, quick stakes, this switch and the help. Before, the settings were only on the phone.
• No change to the integration: nothing new at launch, no new messages, and what the server accepts does not change. The switch is a player preference held by the browser, not an operator setting: the advanced bet stays available in both worlds.

3 October 2026 — the pre-showcase inspection: fairness, money path, hardening#

A line-by-line review of the whole platform before the October showcase, with every finding reproduced before it was fixed. What changes for an integrator and for a player:

• God Candle generator 0.2.0. The forced cash-out near the cap (the "pre-cap rule") is now evaluated before the rug draw of the same epoch, as it already was in the other three games. Up to 0.1.1 a player holding into that zone was paid less than the RTP in expectation (measured: 95.96% instead of 97% at a test cap of 5×; at the production cap the zone is reached in about 0.07% of rounds). Rounds already played remain verifiable: the verifier replays each round with the generator version it recorded, and 0.1.1 stays available for that.
• Mid-round entries are priced at the wallet's reply, not at the request. If the operator's wallet confirms a mid-round bet after the price step has advanced, the entry price is the current one; the stake earns nothing during the wait and carries no risk. Until now the entry kept the requested price, which with a public next-step timestamp was a free option (reproduced on Diamond Hands: a riskless +4% per attempt with a 120 ms wallet). BET_ACCEPTED already carries the actual entry price; the command ledger records the requested step as repricedFrom. Hypnofrog's "born and dies" rule for a fly taken during the wait becomes a refund (BETTING_CLOSED).
• Launch and signed reads: a signature is accepted once. The same x-signature sent again within two minutes answers 401 REPLAY. A retry must be re-signed with a fresh x-timestamp, which the reference connector already does.
• The operator lobby URL now travels inside the signed game token and comes back in HELLO_OK.lobbyUrl; the game URL no longer carries ?lobby=. Nothing to change at launch: lobbyUrl is still the launch field.
• What the client promises on the cash-out button is exactly what the server pays: the payout preview is truncated to the currency's decimals (zero for JPY, three for KWD) and capped at the room's max win, like the settlement.
• Hardening: every environment switch is read with one rule (1|true|yes|on on, 0|false|no|off off); an operator entry with an invalid wallet URL refuses the boot instead of being dropped silently; the public DB probe is memoized; the hub endpoints are rate-limited per IP; the wallet response body is capped in size; a HELLO budget per identity protects the operator's /balance endpoint; config validators reject non-finite numbers.
• Engine gate: every strategy in the fairness harness now also asserts a z-score below 4 (fixed seeds), and a single-step martingale test covers the cap barrier state by state.

2 October 2026 — a guided tour in all four games#

• The first visit teaches on the real interface. The tutorial screens shown before the first round are gone. On a player's first visit a short tour dims the screen around the real elements of the game — the scene where the round plays out, the stake and the column that places it — and explains each in a sentence or two. The rest of the screen (history, balance, advanced bets, chat and leaderboard, help) is one tap away at the end, and the help button replays the whole tour.
• The first time something happens, a short note explains it: the player's first open position, a stake lost to the round's event, a round that ends at its limit. Once per device, at most one per round, and never over the cash-out buttons: the note does not take touches, so a tap on the tile under it still cashes out.
• Never over an open position. The tour does not start while the player has a position open or a stake in flight; if one appears during the tour, the tour steps aside and resumes when the position closes. The round never stops for it.
• Big Fish opens on a title card with a PLAY button that lights up when the 3D models have loaded. As before, that tap is also what unlocks the sound.
• No change to the integration: nothing new at launch, no new messages. The tour remembers that it has been shown in the browser's storage; where storage is blocked (some embedded iframes) it does not start on its own, so it never repeats at every visit, and the help button still opens it. Arrow keys move through it, Esc closes it, and reduced motion is respected.

1 October 2026 — the reality check counts active play#

• Time played is counted by the server, and only while the game is connected and visible. Until now the clock ran from the launch and the client subtracted it on its own device: a tab left in the background counted as play. Now the server credits time from its heartbeat, per player and across rooms, and the client shows the server's figures: the current session (continuous play; a 30-minute absence ends it) and the last 24 hours (kept per player for 30 days).
• In operator builds the reality check is a dialog, shown at the end of the round if a position is open; new stakes are refused with REALITY_CHECK until the player acknowledges it. Open positions can always be cashed out.
• sessionId on the launch, optional. If your lobby has its own session id, pass it: a new value starts a new responsible-gaming session. Without it, a 30-minute absence does.
• Protocol: HELLO_OK.responsible carries sessionMin and last24hMin instead of sessionStartedAt; REALITY_CHECK carries sessionMin, last24hMin, net and ack; new RG_INFO from the server, PRESENCE and RG_ACK from the client. See Compliance and the integration guide.

27 September 2026 — integration 2.1#

Two changes to the integration surface, before any integration is built on 2.0:

• A response also signs its HTTP status and a hash of the request body it answers. Our connector decides on the status of your answer (a signed 4xx is a definitive refusal, a 200 is a debit), so the status is now inside the signature: a proxy that rewrote a 402 into a 200 with the body untouched would have turned a refusal into a live bet. Test vectors updated. See the integration guide.
• English keys on every read. The last Italian keys of the integration are renamed, before anyone reads them: /b2b/report answers with window, rows, subtotals and truncated (rows keyed currency and day, the CSV header too), /b2b/round/:id with outcome, totals and fairness.publicPath, and /fair with persistent, outcome, positions, switches, exit, midRound and verificationPage. A response saved before this date carries the old names (esito, posizioni, cambi, uscita, inCorsa, verifica, storico, righe, subtotali, troncato, finestra, valuta, giorno, totali) and the verification tool says so instead of failing on it.

Also, on the public round verification page:

• Two false alarms fixed. A pre-launch stake on a round that ended at launch (an instant rug or palm) was flagged as an impossible entry, and a mid-round entry could be flagged as overpaid because the stored multiplier is rounded to four decimals while the settlement uses the exact ratio. The verifier now recomputes payouts from the exact path ratio, and a round that ended at launch verifies its lost stakes as such.

September 2026 — integration 2.0#

Breaking changes, for integrations built on version 1.0:

• Signature v2, one rule for every call in both directions. Method, path, timestamp and body are signed, and a response signs the timestamp of the request it answers. Version 1.0 signatures are refused. See the integration guide.
• The launch timestamp moved from the request body to the x-timestamp header.

Everything else:

• Close code 4409. When the same player opens the game in another window, the older one closes and offers to play there again, instead of reconnecting in a loop.
• A new launch starts a new responsible-gaming session; a reconnection continues the same one.
• Game tokens carry their environment: a staging token is refused in production.
• Redirects from the operator's endpoints are never followed: a redirect counts as an ambiguous answer.
• Stakes the wallet confirms after the launch are refunded in God Candle and Diamond Hands too, as they already were in Hypnofrog. In Big Fish such a stake becomes a mid-round drop.
• Round verification recomputes every payout, in all four games.
• Registry checks: currencies with more than two decimals are refused; operator ids use letters, digits, - and _; an enabled value that is not a boolean suspends the operator; operator limits can only tighten a room's.
• A free bet claimed in a real-money room is refused with PROMO_INVALID before the wallet is called.
• The multiplier on /win has four decimals, and the same value on every retry.
• Catalog: mid-round entry is listed for all four games, and stop loss for God Candle only.
• This documentation, online.

22 September 2026#

• Hypnofrog, the fourth game, as a playable preview.
• Free bets in demo rooms: a welcome free bet on a player's first visit to a room.
• The early-churn signal: a tip in the game, a message to the lobby, and an optional signed webhook to the operator.
• Per-player promotion opt-out, as a signed call.
• The closing multiplier on every settlement: /win carries the multiplier the position closed at, and 0 on a loss.
• A position's maximum win is fixed when its stake is accepted.
• In Diamond Hands and Big Fish, a command is priced by the time the server received it, also when the wallet queue is busy.

13 September 2026#

• Round reservation: a round's number is reserved in the database before any bet is accepted.
• Durable outcomes: a real-money cash-out is confirmed once its outcome is stored, and delivered to the wallet after that, idempotently.
• Settlement export: GET /b2b/settlements, in JSON or CSV.
• Kill-switch: pause a room, or suspend an operator.
• Public round verification: GET /fair/<room>/<round>/verifica.