> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://pos-api-docs.lucky-tom.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://pos-api-docs.lucky-tom.com/_mcp/server.

# Overview

# Lucky-Tom POS API

Partner backends and POS terminals. Sister collection: **Lucky-Tom Casino** (Team Workspace) — Game Provider inbound HMAC + SeamlessWallet outbound (no HMAC).

Open **Authentication** first. Auth is **AND, not OR**: Partner-Id + Bearer `client_secret` + HMAC (`hmacSecretKey`) on every request.

Canonical string: `{METHOD}\n{pathAndQuery}\n{timestamp}\n{sha256HexOfRawBody}`

Empty body SHA-256 is always `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`. Clock skew ±5 minutes → `422 hmac-skew`. Identity failure → `401 unauthorized`. Signature failure → `422 hmac-invalid`.

This collection's Pre-request Script signs `/v1/api/pos/` only when `hmacSecretKey` is set. Timestamp and Signature headers are placeholders; Send overwrites them.

Select environment **Lucky Tom UAT** or **Lucky Tom Production**. Fill `partnerId`, `clientSecret`, `hmacSecretKey`.

Do not Send the Authentication documentation request. Postman Authorization tab is unused on purpose (AND, not OR).