Launch Game ✓ Done

Overview

• Description: Apply to enter a specific game. This interface handles multi-platform adaptation (User-Agent detection), single-wallet balance consistency (unsettled wager check), and anti-reentry locks (debounce lock + single-game lock).
• Authentication: Login Required. Must supply the player's Member Token in the Request Header (Authorization: Bearer <member_token>). Unauthenticated or invalid token requests will be rejected.

Underlying Business Logic & Security Guards

WARNING

The game launch interface is the most critical core entry point of the platform. The following defense mechanisms MUST be strictly retained:

1. High Concurrency Anti-Debounce Lock: When a player requests to launch a game, the system applies an exclusive lock via Redis SETNX launch:lock:{memberId} (TTL 3 seconds). This prevents duplicate clicks caused by network lag from creating duplicate sessions with third parties. On conflict, the API returns 429; if Redis fails, the request is allowed through as a degraded fallback.
2. Single-Wallet Balance Consistency: Before allowing a player to enter a new game, the system queries the hub_callback_wager collection for unsettled wagers with status=BET. If any exist, entry is blocked until the wager is settled (reconnecting to the same game is not affected). The local balance in Mongo member_wallet is authoritative and is synchronized in real time via Hub BetPush/Balance callbacks.
3. Fund Protection While In-Game: While a player is in a game (Redis single-game lock exists), withdrawals and currency exchanges are blocked, preventing local withdrawals while funds are held by the third party. The local balance is NOT zeroed out.
4. Adaptive Multi-Platform Response: If platform is not passed, it is auto-detected from the User-Agent (WEB/MOBILE). For special games configured with isapp=true (e.g., 918Kiss, Mega888), an app-wakeup protocol and download link (dwnlink) are returned instead of an H5 link.

IMPORTANT

1. Mandatory Login Authentication: This interface verifies the player identity via VerifyMemberToken. Requests without valid login status will be denied.
2. Single Sign-On (SSO) Guard: If single-device login enforcement is enabled, requests will be blocked with a logged in elsewhere error when duplicate logins on other devices are detected.
3. Agent Credentials Association: The backend automatically retrieves the corresponding PanelApiKey and PanelSecretKey based on the player's agent (agent_id) to invoke the underlying Hub API securely.
4. Auto Registration & Wallet Creation: On a player's first attempt to launch a game from a specific provider, the Hub system automatically registers the player and initializes their currency wallet.

NOTE

When the backend calls Hub's /papi/v1/game/launch, the member_id is the player's native username (same as the exit game /client/games/exit and the admin kick-player feature). Hub automatically registers the player account and creates the wallet under this username.

---

1. POST - Get Game Launch URL

• Path: /client/games/url
• Content-Type: application/json or application/x-www-form-urlencoded

Request Headers

Header	Type	Required	Description
Authorization	String	Yes	Member Token in format Bearer <token>
Accept-Language	String	No	Target response language (e.g., en-US, zh-CN)

Request Parameters

Parameter	Type	Required	Description
game_id	String	Yes	Hub game ID (game_list.hub_game_id) or the id / hub_game_id from the Game List API
platform	String	No	WEB / MOBILE / DESKTOP. If not passed, auto-detected via User-Agent. Default: WEB
language	String	No	Language; defaults to player preference, then en-US
return_url	String	No	Game return URL
currency	String	No	Currency (e.g., MYR, USD); defaults to agent main currency

Response Fields

Field	Type	Description
game_url	String	Complete launch URL for entering the game

Response Example (Success)

{
  "status": true,
  "code": 0,
  "data": {
  "data": {
    "game_url": "https://thirdparty.com/launch?token=xxxxx",
    "isapp": false,
    "dwnlink": ""
  },
  "msg": "Success"
}

Response Example (Unauthorized / Token Expired)

{
```json
{
  "status": false,
  "code": 700,
  "msg": "verify_failed: unauthorized",
  "data": null
}

Response Example (Logged In Elsewhere)

{
  "status": false,
  "code": 700,
  "msg": "verify_failed: logged in elsewhere",
  "data": null
}

Success Example (Native app wake)

{
  "status": true,
  "code": 0,
  "data": {
    "game_url": "pussy888://launch",
    "isapp": true,
    "dwnlink": "https://download.pussy888.com"
  },
  "msg": "Success"
}

Error Response Example (Blocked by Debounce Lock)

{
  "status": false,
  "code": 429,
  "data": null,
  "msg": "Another launch request is being processed. Please try again in a moment."
}

}

### Error Response Example (Unsettled Wagers Exist)

```json
{
  "status": false,
  "code": 7,
  "data": {},
  "msg": "You have unsettled wagers. Please wait for settlement before starting a new game."
}

NOTE

The msg field is returned according to the player's language (from the JWT language claim, x-language header, or player profile). The examples above show English (en_us) messages.