Developer portal

Card-linked transaction notifications for gaming operators. When a cardholder who has linked their card to your platform makes a purchase, we send your server an encrypted, signed webhook within seconds, so you can offer them a wager sized to the purchase.

Access is by invitation. If your company is onboarding with us, your first admin account is created by our team; your admins invite everyone else.

Documentation

Overview

A cardholder links a payment card to your platform once, through our hosted enrollment page. Mastercard records the cardholder's consent. From then on, each purchase on that card produces a transaction webhook to the URL you register, carrying the amount, currency, merchant and the last four digits of the card. We never send or hold the full card number. Each webhook is signed by us and encrypted to your key, so only you can read it.

Getting started

1. Sign in to Management. Your account uses a password plus an authenticator app, which you set up the first time you sign in.
2. Create an API credential (client id and secret). The secret is shown once: store it in your secrets manager.
3. Register your webhook URL and your public encryption key.
4. Register your return origins: the origins we may send cardholders back to after enrollment.
5. Press Send test notification and check that your server can verify and decrypt it.
6. Create an enrollment session for a cardholder and send them to its enroll_url.

Everything in Management can also be done through the API, except credentials and team members.

Authentication

The API uses the OAuth 2.0 client credentials grant. Exchange your credential for an access token, then send it as Authorization: Bearer <token>.

POST https://api.reengagementcorp.com/oauth2/token
Authorization: Basic base64(client_id:client_secret)
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials

Tokens last 60 minutes. Cache the token and reuse it until shortly before it expires: the token endpoint is limited to 2 requests a second. Without a scope parameter the token carries all of the credential's scopes. To ask for fewer, send scope as a space-separated list:

Rotating a credential: you can hold two active credentials. In Management, press Rotate to create the second one, deploy it, then revoke the old one. A revoked credential is refused on its next request, even if it still holds an unexpired token.

Card enrollment

Before creating sessions, register a webhook URL, an encryption key and the return origin your return_url uses.

POST https://api.reengagementcorp.com/v1/enrollment-sessions
Authorization: Bearer <token with the enroll scope>
Idempotency-Key: 7d0c6f1e-signup-42
Content-Type: application/json

{"external_user_id": "player-42", "return_url": "https://casino.example/cards/linked"}

• external_user_id: your id for the player, 1–256 printable characters. It comes back as the webhook's sub. Don't use an email address or anything else personal.
• Idempotency-Key: 1–64 letters, digits, - or _. Repeating a request with the same key returns the same session.
• The response (201) holds session_id, status, expires_at and enroll_url. Send the cardholder to enroll_url within 30 minutes. They enter their card in Mastercard's own form; it never touches your systems or ours.
• Afterwards the cardholder returns to your return_url. Poll GET /v1/enrollment-sessions/{id} (pending, completed or expired), or wait for the enrollment.completed webhook. Use the webhook as confirmation, not the return.

Webhooks

We POST each event to your webhook URL from 34.198.168.58 (allowlist it if you filter by IP).

• The URL must be https on port 443, with a public DNS name (no IP addresses) and at most 2048 characters. We don't follow redirects.
• Headers: Content-Type: application/jose, TTW-Delivery-Id, TTW-Attempt (1, 2, …) and User-Agent: TTW-Webhooks/1.

The body is a compact JWE: alg ECDH-ES+A256KW, enc A256GCM, cty JWT. The kid header names your encryption key.

Decrypt it with your private key. The plaintext is a compact JWS (ES256) signed by us. Verify it against our public keys at https://keys.reengagementcorp.com/.well-known/jwks.json, using the JWS's kid. Refetch that JWKS when you see an unknown kid.

Then check the claims:

Delivery and retries:

• Reply with any 2xx within 5 seconds, and process the event afterwards.
• A timeout, a network error, 408, 429 or a 5xx is retried after 10, 30, 60, 120, 300 and 300 seconds.
• Any other status ends delivery.
• We stop retrying 15 minutes after the purchase. Delivery is at least once, so expect duplicates.

Encryption keys

Register the public half of an EC P-256 key as a JWK: kty EC, crv P-256, x and y, and optionally alg ECDH-ES+A256KW. Never send the private key: we reject any JWK that contains d.

The kid is the key's RFC 7638 thumbprint. Omit it and we compute it.

Two keys can be active, and we encrypt to the newest. To rotate: add the new key, make sure your receiver can decrypt with either key, then retire the old one. A retired key can't be added again.

Consents

Each enrolled card is a consent. GET /v1/consents lists yours, 100 a page, oldest first. You can filter by external_user_id and status (active or revoked); pass next_cursor back as cursor to get the next page.

When a player asks to unlink their card, call DELETE /v1/consents/{id}:

• Notifications stop at once.
• We delete the consent at Mastercard within minutes.
• On a revoked consent, network_revocation shows pending until that is done, then completed, with network_revoked_at.

A consent can also end on Mastercard's side. It then shows revoked_by network.

Test notifications

POST /v1/test-notification (or the button in Management) sends a signed and encrypted test event to your webhook through the same pipeline as real events. The response (202) holds test_id and the delivery_id to look for. You can send one a minute.

Errors and limits

Errors are application/problem+json (RFC 9457): type, title, status and sometimes detail. Branch on type, for example https://api.reengagementcorp.com/problems/no-webhook.

The API allows bursts of up to 40 requests and 20 a second sustained; the token endpoint allows 2 a second.

API reference

Base URL https://api.reengagementcorp.com. Machine-readable spec: openapi.yaml.

Log in

Sign in with your developer portal account. You'll enter your email, password and the code from your authenticator app on our sign-in page at login.developer.reengagementcorp.com, then come straight back here.

Sign in

No account? Ask an admin at your company to invite you. New companies are onboarded by our team.

Signing in

Signing you in…

Not found

There's nothing at this address. Go to the start page.

Management