Embed Crypto Flight X in your lobby

import { createHmac, timingSafeEqual } from "crypto";

// Your endpoint, set as "Wallet API URL" in the operator console.
app.post("/cfx/wallet", express.raw({ type: "*/*" }), (req, res) => {
  const raw = req.body.toString("utf8");
  const ts  = req.header("x-cfx-timestamp");
  const sig = req.header("x-cfx-signature");

  // Verify the call really came from Crypto Flight X.
  const expected = createHmac("sha256", API_KEY)
    .update(`${ts}.${raw}`)
    .digest("hex");
  if (!timingSafeEqual(Buffer.from(sig), Buffer.from(expected)))
    return res.status(401).json({ ok: false, error: "bad signature" });

  const { type, playerId, amount, currency, idempotencyKey } = JSON.parse(raw);
  // type = "debit" (bet) | "credit" (win). Use idempotencyKey to dedupe.
  const balance = applyToWallet({ type, playerId, amount, currency, idempotencyKey });

  res.json({ ok: true, balance, providerRef: idempotencyKey });
});

// Your "Webhook URL" receives signed round.settled events.
app.post("/cfx/webhook", express.raw({ type: "*/*" }), (req, res) => {
  const raw = req.body.toString("utf8");
  const ts  = req.header("x-cfx-timestamp");
  const sig = req.header("x-cfx-signature");
  const expected = createHmac("sha256", API_KEY).update(`${ts}.${raw}`).digest("hex");
  if (sig !== expected) return res.sendStatus(401);

  const e = JSON.parse(raw); // { event:"round.settled", roundId, win, winAmount, crashPoint, fairness }
  recordRoundResult(e);
  res.sendStatus(200);
});

// Provably fair: after a session ends, reveal the server seed and re-derive
// every crash point yourself (or call /round/reveal):
//   serverSeedHash === sha256(serverSeed)
//   h = first 52 bits of HMAC_SHA256(serverSeed, clientSeed + ":" + nonce)
//   crashPoint = floor((100*2^52 - h)/(2^52 - h))/100 * (1 - houseEdge)