API Documentation v2.2
XS-BD-WIN is a secure Game Api automation platform designed for Bangladeshi merchants. Integrate our API to accept Game Apis via bKash, Nagad, and other local methods directly into your application.
Base URL:
https://api.xsbdwin.online
Authentication
POST
API Key Auth
All API requests require authentication using your Domain API Key in the header.
| Header Name | Value | Required |
|---|---|---|
X-Signature-Key |
Your Domain API Key | YES |
Content-Type |
application/json | YES |
LUNCH GAME
installing Game Servar
Variables needed to POST to initialize the Game Api process in the gateway URL.
| Field Name | Description | Req | Example |
|---|---|---|---|
dn_cn |
Customer Full Name (was cus_name) | YES | John Doe |
dn_ce |
Customer Email (was cus_email) | YES | customer@email.com |
dn_am |
Total amount (was amount). Skip trailing zeros. | YES | 10 |
dn_su |
Success URL (was success_url) | YES | yourdomain.com/success |
dn_cu |
Cancel URL (was cancel_url) | YES | yourdomain.com/cancel |
dn_wu |
Webhook IPN URL (was webhook_url) | NO | yourdomain.com/webhook |
dn_mt |
JSON Meta Data (was meta_data) | NO | {"phone":"016**"} |
dn_rt |
Return Type | NO | GET |
<?php
$api_key = "YOUR_API_KEY";
$api_url = "https://api.xsbdwin.online/v2/order/synchronize/prepare";
$raw_data = [
"dn_su" => "yourdomain.com/success", "dn_cu" => "yourdomain.com/cancel",
"dn_wu" => "yourdomain.com/webhook", "dn_am" => "10",
"dn_cn" => "Customer Name", "dn_ce" => "customer@email.com",
"dn_mt" => json_encode(["phone" => "016****"]), "dn_rt" => "GET"
];
$payload = base64_encode(json_encode($raw_data));
$signature = hash_hmac('sha256', $payload, $api_key);
$ch = curl_init($api_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(['dp_payload' => $payload]));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
"X-Signature-Key: $api_key",
"donia-signature: $signature",
"Content-Type: application/json"
]);
$response = curl_exec($ch);
curl_close($ch);
echo $response;
?>
<?php
require 'vendor/autoload.php';
use GuzzleHttp\Client;
$api_key = "YOUR_API_KEY";
$raw_data = [
"dn_su" => "yourdomain.com/success", "dn_cu" => "yourdomain.com/cancel",
"dn_wu" => "yourdomain.com/webhook", "dn_am" => "10",
"dn_cn" => "Customer Name", "dn_ce" => "customer@email.com",
"dn_mt" => json_encode(["phone" => "016****"]), "dn_rt" => "GET"
];
$payload = base64_encode(json_encode($raw_data));
$signature = hash_hmac('sha256', $payload, $api_key);
try {
$response = (new Client())->post('https://api.xsbdwin.online/v2/order/synchronize/prepare', [
'headers' => ['X-Signature-Key' => $api_key, 'donia-signature' => $signature],
'json' => ['dp_payload' => $payload]
]);
echo $response->getBody();
} catch (\Exception $e) {
echo $e->getMessage();
}
?>
const axios = require('axios'), crypto = require('crypto');
const apiKey = "YOUR_API_KEY", apiUrl = "https://api.xsbdwin.online/v2/order/synchronize/prepare";
const rawData = {
"dn_su": "yourdomain.com/success", "dn_cu": "yourdomain.com/cancel",
"dn_wu": "yourdomain.com/webhook", "dn_am": "10",
"dn_cn": "Customer Name", "dn_ce": "customer@email.com",
"dn_mt": JSON.stringify({ "phone": "016****" }), "dn_rt": "GET"
};
const payload = Buffer.from(JSON.stringify(rawData)).toString('base64');
const signature = crypto.createHmac('sha256', apiKey).update(payload).digest('hex');
axios.post(apiUrl, { dp_payload: payload }, {
headers: { 'X-Signature-Key': apiKey, 'donia-signature': signature }
})
.then(res => console.log(res.data))
.catch(err => console.error(err.response ? err.response.data : err.message));
import requests, json, base64, hmac, hashlib
api_key = "YOUR_API_KEY"
url = "https://api.xsbdwin.online/v2/order/synchronize/prepare"
raw_data = {
"dn_su": "yourdomain.com/success", "dn_cu": "yourdomain.com/cancel",
"dn_wu": "yourdomain.com/webhook", "dn_am": "10",
"dn_cn": "Customer Name", "dn_ce" : "customer@email.com",
"dn_mt": json.dumps({"phone": "016****"}), "dn_rt": "GET"
}
payload = base64.b64encode(json.dumps(raw_data).encode()).decode()
sig = hmac.new(api_key.encode(), payload.encode(), hashlib.sha256).hexdigest()
try:
res = requests.post(url, json={'dp_payload': payload}, headers={
'X-Signature-Key': api_key, 'donia-signature': sig
})
print(res.text)
except Exception as e:
print(f"Error: {e}")
const crypto = require('crypto');
const apiKey = "YOUR_API_KEY", url = "https://api.xsbdwin.online/v2/order/synchronize/prepare";
const rawData = {
"dn_su": "yourdomain.com/success", "dn_cu": "yourdomain.com/cancel",
"dn_wu": "yourdomain.com/webhook", "dn_am": "10",
"dn_cn": "Customer Name", "dn_ce": "customer@email.com",
"dn_mt": JSON.stringify({ "phone": "016****" }), "dn_rt": "GET"
};
const payload = Buffer.from(JSON.stringify(rawData)).toString('base64');
const sig = crypto.createHmac('sha256', apiKey).update(payload).digest('hex');
fetch(url, {
method: 'POST',
headers: { 'X-Signature-Key': apiKey, 'donia-signature': sig, 'Content-Type': 'application/json' },
body: JSON.stringify({ dp_payload: payload })
})
.then(res => res.text()).then(console.log).catch(console.error);
Response Details
| Field | Description |
|---|---|
| Success | |
status | TRUE |
message | Message for Status |
Game Api_url | Game Api Link (redirect here) |
| Error | |
status | FALSE |
message | Error description |
Verify Game Api
Redirect Query Parameters: Completing the Game Api Page task, you will be redirected to the success or cancel page based on transaction status with the following params:
yourdomain.com/(success|cancel)?transactionId=******&Game ApiMethod=***&Game ApiAmount=**.**&Game ApiFee=**.**&status=pending|success|failed
Verification Parameters
| Field Name | Description | Req | Example |
|---|---|---|---|
transaction_id |
Transaction ID received as query parameter. | YES | OVKPXW165414 |
Verification Response
| Field | Type | Description |
|---|---|---|
| Success Fields | ||
status | string | COMPLETED, PENDING, or ERROR |
cus_name | string | Customer Full Name |
cus_email | string | Customer Email |
amount | string | Transaction Amount |
transaction_id | string | Unique Transaction ID |
metadata | JSON | Custom metadata passed |
| Error Fields | ||
status | bool | Returns false |
message | string | Error reason |
<?php
$api_key = "YOUR_API_KEY";
$api_url = "https://api.xsbdwin.online/v2/order/synchronize/confirm";
$ch = curl_init($api_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(["transaction_id" => "ABCDEFH"]));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
"X-Signature-Key: $api_key",
"Content-Type: application/json"
]);
$response = curl_exec($ch);
curl_close($ch);
echo $response;
?>
<?php
require 'vendor/autoload.php';
use GuzzleHttp\Client;
$api_key = "YOUR_API_KEY";
$api_url = "https://api.xsbdwin.online/v2/order/synchronize/confirm";
$client = new Client();
try {
$response = $client->post($api_url, [
'headers' => [
'X-Signature-Key' => $api_key,
'Content-Type' => 'application/json',
'Accept' => 'application/json',
],
'json' => [
'transaction_id' => 'ABCDEFH'
]
]);
echo $response->getBody();
} catch (\Exception $e) {
echo "Error: " . $e->getMessage();
}
?>
const apiKey = "YOUR_API_KEY", url = "https://api.xsbdwin.online/v2/order/synchronize/confirm";
fetch(url, {
method: 'POST',
headers: { 'X-Signature-Key': apiKey, 'Content-Type': 'application/json' },
body: JSON.stringify({ transaction_id: "ABCDEFH" })
})
.then(res => res.json()).then(console.log).catch(console.error);
import requests
key = "YOUR_API_KEY"
url = "https://api.xsbdwin.online/v2/order/synchronize/confirm"
try:
res = requests.post(url, json={"transaction_id": "ABCDEFH"}, headers={"X-Signature-Key": key})
print(res.text)
except Exception as e:
print(f"Error: {e}")
package main
import (
"bytes"
"fmt"
"io"
"net/http"
)
func main() {
payload := []byte(`{"transaction_id":"ABCDEFH"}`)
req, _ := http.NewRequest("POST", "https://api.xsbdwin.online/v2/order/synchronize/confirm", bytes.NewBuffer(payload))
req.Header.Set("X-Signature-Key", "YOUR_API_KEY")
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
fmt.Println(err)
return
}
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}
Sample JSON Response
{
"cus_name": "John Doe",
"cus_email": "johndoe@gmail.com",
"amount": "900.000",
"transaction_id": "OVKPXW165414",
"metadata": {
"phone": "015****"
},
"Game Api_method": "bkash",
"status": "COMPLETED"
}