POS (AND, not OR)

Do not Send. Documentation only. This collection is POS only.

Lucky Tom does not offer a menu of auth methods. POS requires identity + Bearer + HMAC together (AND, not OR).

Canonical string (UTF-8, four lines, no trailing newline after the body hash):

{METHOD}
{pathAndQuery}
{timestamp}
{sha256HexOfRawBody}

Empty body SHA-256 is always e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Clock skew ±5 minutes → 422 hmac-skew. Identity failure → 401 unauthorized. Signature failure → 422 hmac-invalid. POS {countryId} ≠ credential → 403 country-mismatch.

client_secret and HMAC_SECRET_KEY are two different secrets. Idempotency-Key is not in the canonical string.

Postman on this collection

1. Select Lucky Tom UAT or Lucky Tom Production.
2. Set hmacSecretKey (never equal to clientSecret).
3. Set partnerId + clientSecret.
4. On Send, the collection Pre-request Script overwrites Timestamp/Signature for /v1/api/pos/ only.
5. Sign the exact JSON bytes you send. Pretty-print changes the signature.
6. Retry timeouts with a fresh timestamp/signature and the same idempotency key + body.

Postman Authorization tab is unused on purpose: configuring Bearer there would look like an alternative to HMAC.

Game Provider and SeamlessWallet live in Lucky-Tom Casino. The full worked HMAC example is in docs/api/hmac.md.