Legend Fire

Overview#

FastAPI provides a simple and secure way to integrate with third-party platforms for account creation, deposits, and withdrawals.

Preparations

The integrator must obtain the following authorization details:

• API Server Domain.
• appid: API integration identification ID.
• appsecret: API authentication private key.

The integrator must provide their server IP address to be added to the API access whitelist.

Endpoints

Request format#

Unless specified otherwise, API requests should use HTTP POST with application/x-www-form-urlencoded format.

Example JSON Request:

{
  "appid": "h63inikngg2qyoii",
  "timestamp": 1701401242061,
  "sign": "c685901b15253d820dc1bc062d21d4f1"
}

Response format

All API responses follow this format:

{
  "msg": "message",
  "code": 0,
  "data": {object}
}

Request signature#

This signature is used when the client sends requests to the FastAPI server.

1. Exclude the sign field from parameters.
2. Sort the remaining fields in ascending order by parameter name.
3. Format each parameter as key=value, then concatenate them using the & character to form the parameter string.
4. Append the given appsecret to the end of the concatenated parameter string.
5. Generate the signature by applying the MD5 hash algorithm to the resulting string.
6. For POST requests (with JSON) and GET requests (with URL parameters), apply the same sorting and signing process.
7. The server will only accept requests within 5 minutes of the provided timestamp.

Signature code example

function sign(array $data, string $appSecret)
{
    unset($data['sign']);
    $params = array_map(function ($value) {
        if (is_array($value)) {
            $value = json_encode($value);
        } elseif (is_bool($value)) {
            $value = var_export($value, true);
        }
        return $value;
    }, $data);
    ksort($params);
    $strArr = [];
    foreach ($params as $key => $value) {
        $strArr[] = $key . '=' . $value;
    }
    return md5(implode('&', $strArr) . $appSecret);
}

Response codes#

Description of the code field values in API responses:

AES decryption of appsecret_encrypted#

1. Perform base64_decode on the appsecret_encrypted string returned by the agent login API.
2. Extract the first 16 characters as the initialization vector (IV), and use the remaining characters starting from the 17th as the data to be AES decrypted.
3. Convert the agent password to lowercase, then apply MD5 hashing twice to generate the AES decryption key.
4. Use the AES-256-CBC algorithm to decrypt the data using the key and IV to obtain the appsecret.

Sample AES decryption code

function aesDecrypt($data, $key) {
  $data = base64_decode($data);
  $iv = substr($data, 0, 16); // Extract the first 16 bytes as IV
  $encrypted = substr($data, 16); // The rest is the encrypted data
  return openssl_decrypt($encrypted, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
}

Agent Login#

POST/fast/agent/login

The appsecret_encrypted returned by the API has been encrypted using the AES algorithm. In order to use the actual appsecret, the client must perform AES decryption as described in AES decryption.

Headers

Body

Response data

Create Player#

POST/fast/user/create

Headers

Body

Response data

Deposit#

POST/fast/user/deposit

Headers

Body

Response data

Withdrawal#

POST/fast/user/withdrawal

Headers

Body

Response data

Get Balance#

POST/fast/user/balance

Headers

Body

Response data

Get Balance (With Password)#

POST/fast/user/balanceWithPasswd

Headers

Body

Response data

Change Password#

POST/fast/user/updatePasswd

Headers

Body

Response data

Get Trade List#

POST/fast/user/tradeList

Headers

Body

Response data

Get Gamelog List#

POST/fast/user/gameLogList

Note: Retrieve up to the latest 1,000 game records.

Headers

Body

Response data