PrizestackAPI

Quickstart

1. Get a key. Get in touch and we create your campaign and a pr_test_ key the same day. Test campaigns record entries and run draws that pay nothing.
2. Hash your player id. entrantId = HMAC-SHA256(playerId, your secret). We never see raw player ids.
3. Send one call per qualifying event with your own event id. 20 entries on a first deposit, 1 per $25 wagered, whatever your rule says. Send it before 16:00 UTC and it is in tonight's draw.
4. Show it to players. Render the prize table, the player's entries, the countdown and results from the campaign endpoint in your own UI. A hosted player page per campaign ships with your onboarding.

Entries API

In increment mode every call adds to the entrant's total for the open drawing. Each entrant's chance in the draw is proportional to their entries. Entries are free and your fee does not change with the count.

POST /api/v1/campaigns/your-casino/entries
Authorization: Bearer pr_live_••••••••
Content-Type: application/json

{
  "mode": "increment",
  "entrants": [
    { "entrantId": "hmac:7f3a9c…", "entries": 20, "eventId": "ftd_90412" },
    { "entrantId": "hmac:c01d44…", "entries": 1,  "eventId": "wager_771902" }
  ]
}

200 OK
{
  "drawing": { "day": "2026-10-29", "drawAt": "2026-10-29T17:00:00.000Z", "cutoffAt": "2026-10-29T16:00:00.000Z" },
  "added": 1,        // entrants new to today's drawing
  "updated": 1,      // entrants that already had entries today
  "unchanged": 0,    // entries: 0
  "duplicates": 0,   // same eventId, same payload (no-op)
  "entrantCount": 418,
  "totalEntries": 1284
}

Limits: 1 to 500 entrants per call, 0 to 100 entries per entrant per call, entrantId and eventId up to 128 characters. Entries above the campaign's daily cap per player are ignored, and the response counts them under unchanged.

GET /api/v1/campaigns/your-casino
Authorization: Bearer pr_live_••••••••

200 OK
{
  "campaign": { "slug": "your-casino", "status": "active", "casino": "your-casino", "plan": "starter", "createdAt": "…" },
  "rule": { "ftd": 20, "perDepositUsd": 25, "perDepositTickets": 1, "perWagerUsd": 25, "perWagerTickets": 1, "dailyCap": 20, "cooldownMin": 60 },
  "drawing": { "day": "2026-10-29", "drawAt": "…T17:00:00.000Z", "cutoffAt": "…T16:00:00.000Z" },
  "today": { "entrantCount": 418, "totalEntries": 1284 }
}

Postbacks

If your affiliate software already fires postbacks, point it at us instead of integrating. Same rule engine, same entries. Idempotent on (source, txid); a reversal with the original txid cancels an entry grant that has not been submitted to a draw yet.

GET https://prizestack.cx/api/postback/{source}
  ?clickid={clickid}      // the Prizestack click id you stored at registration
  &event=ftd              // reg | ftd | deposit | wager | reversal
  &amount=50.00&currency=USD
  &txid={your transaction id}   // idempotency key per source
  &player={your player id}      // optional, hashed on your side
  &sig={HMAC-SHA256 of the canonical params with your own secret}

200 { "ok": true, "tickets": 20, "eventId": "…" }

Money events are held for the reversal window (7 days by default) before the entries are submitted, unless your plan waives the hold, in which case they go into the same day's draw. The full contract, events, signing and testing are in tracking and postbacks.

Errors

Every error body is { "error": "<code>", "detail": "…" }. 5xx responses are safe to retry with the same payload.

Keys and environments

Keys are Bearer tokens that start with pr_. A key belongs to one account and sees only that account's campaigns. pr_test_ keys run against a test campaign: entries are recorded, drawings follow the real clock, no prizes are paid and the player page shows a test banner. pr_live_ keys enter real draws. Rotate a key from the partner portal; the old key stops within 60 seconds.

• Base URL https://prizestack.cx (our own domain)
• Auth Authorization: Bearer pr_…
• Rate limit 60 calls a minute per key, batch up to 500 entrants per call
• Timeouts answer within 2 seconds, or 5xx

Idempotency

eventId is the idempotency key, scoped to the campaign. Repeat a call with the same eventId and the same payload and you get a 200 with the entrant under duplicates. Repeat it with a different entrantId or entries and you get 409 event_conflict; nothing changes. Use your own transaction or ledger id, never a timestamp. Retries on network errors are safe.

Geo rules

Players must be 18 or older (19 in Alabama and Nebraska, 21 in Mississippi). Residents of Florida, New York and Rhode Island cannot enter, nor can residents of countries under US sanctions (OFAC). Filter those players before you send events. Entries for excluded players are your responsibility under the campaign terms; we add a geo flag to the hosted page and never enter an entrant you mark excluded with "entries": 0. Your own licence restrictions apply to deposits on top.

The daily clock

• Until 16:00 UTC entries count for today's drawing. At the lock a public fingerprint of the entrant list is recorded, so nothing can be added or changed afterwards.
• 16:00 to 17:00 UTC the list is locked. Calls may return 409 no_open_drawing; retry after the draw and the entry counts for tomorrow.
• 17:00 UTC the draw runs on a public random value drawn after the lock. Every draw has winners, from $10 up. Results and the proof file are on the hosted page within minutes.
• Within the hour the prize money is paid to you and the winners are in the campaign results endpoint, so you can credit them in-app. Prizes of $600 or more are released after the winner completes the identity check at the link we return.