Admin panel
Admin — access, staff and history
IP Whitelist (owner)#
The allowlist decides which server addresses may call /gameActions.do and /playerRtp.do for a project (Authentication).
- The screen has a form — Partner (project id) and CIDR (for example
203.0.113.0/24,203.0.113.7/32or an IPv6 network) — and two buttons: Add and Delete, plus a table of all entries. - Adding the same network twice does nothing. Deleting asks for confirmation.
- A request from an address that is not covered is answered with
IP_NOT_ALLOWED(HTTP 403).
Staff (owner)#
Create and edit the accounts of your back office.
| Field | Notes |
|---|---|
| Username | Set at creation |
| Display name | Defaults to the username |
| Role | operator, viewer or owner |
| Password | At least 8 characters; leave empty when editing to keep it |
| Enabled | A disabled account cannot sign in |
| Permissions | game-history, api-logs, launch-game, freespins-view, freespins-grant, freespins-delete, configure-projects — see Getting started |
| Projects | The projects the account may see; an owner sees all |
A summary under the form shows the role, how many permissions are granted and which projects are covered. Give each person the least access they need: for example support staff usually need game-history and api-logs for their project only.
Change history and audit#
Several places show who changed what and when:
| Where | What is recorded |
|---|---|
| Projects → project → Payouts / RTP | The version history of project settings (revision, time) |
| RTP & players → player → Journal | Every change of a player's RTP: binding, rule steps, manual changes with the actor and reason |
| API Logs | Every wallet callback attempt: time, method, status, latency, HTTP status and error code (secrets masked) |
| Game History → round | Wallet operations and API calls of a round |
| Free spins, Target outcomes | Who created each entry and when it was applied |
Sensitive administrative actions — saving project settings, revealing or regenerating an API key, changing or testing the callback URL, granting or cancelling free spins, scheduling or cancelling target outcomes — are additionally recorded in the platform's audit log, with the acting account. The log is kept on the server; the panel does not have a separate audit screen. Contact the platform owner if you need an extract.