Lucky-Tom POS API

Partner backends and POS terminals. Sister collection: Lucky-Tom Casino (Team Workspace) — Game Provider inbound HMAC + SeamlessWallet outbound (no HMAC).

Open Authentication first. Auth is AND, not OR: Partner-Id + Bearer client_secret + HMAC (hmacSecretKey) on every request.

Canonical string: {METHOD}\n{pathAndQuery}\n{timestamp}\n{sha256HexOfRawBody}

Empty body SHA-256 is always e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Clock skew ±5 minutes → 422 hmac-skew. Identity failure → 401 unauthorized. Signature failure → 422 hmac-invalid.

This collection’s Pre-request Script signs /v1/api/pos/ only when hmacSecretKey is set. Timestamp and Signature headers are placeholders; Send overwrites them.

Select environment Lucky Tom UAT or Lucky Tom Production. Fill partnerId, clientSecret, hmacSecretKey.

Do not Send the Authentication documentation request. Postman Authorization tab is unused on purpose (AND, not OR).