Platform auth
POST Register /api/auth/register
POST Login /api/auth/login
POST Verify OTP /api/auth/verify-otp
On success the JWT + account id are saved to this session automatically.
POST Logout /api/auth/logout
Ends the session server-side: invalidates every outstanding token for this account and closes open game sessions. Requires a signed-in session.
Wallet
POST Deposit /api/wallet/deposit
GET Balance /api/wallet
Games
POST Launch /api/games/launch
Provider callbacks (simulated, dev only)
POST Callback tester /console/gp → /gameprovider/*
These are signed server-side so
client_secret never reaches the browser. This helper is disabled when NODE_ENV=production.