Porq Game wires the real client protocols of 13 casino providers — sessions, balances, encrypted bet channels, cashouts — behind a single REST API with one API key. No screen-scraping, no invented payloads: every request is built field-for-field from the provider's own client.
Read the docs QuickstartLive wiring status — exactly as it is, per provider. Full notes in the docs.
JWT session flow proven end-to-end (settings → profile → JWT → history). Sessions need a fresh operator token; the sample token is expired. The provider 403s some datacenter egress IPs.
AviatorX + K3. Bet payloads are ECDH P-256 → AES-256-GCM encrypted exactly as the client does; cashout is a WebSocket frame. Sessions expire — bring a fresh launch URL per session.
Same encrypted placebet-enc channel as CrashLive. Bets need caller-supplied windowType / betMarketInfo. There is no cashout — settlement is server-side.
Auth chain, single / subscription / batch bet builders wired. Cashout is expressed as a bet field, not a separate call.
Live-casino hub over socket.io (EIO3). Session open + balance + history proven live; DoBet envelope built for 47 games. Fun launches create anonymous spectator sessions (no wallet); real mode needs an operator token launch.
Legacy /order/ bets plus originals placeBet / cashOut / autocashout builders wired. Heads-up: the provider-side operator auth endpoint was returning 503 on 2026-11-02; originals also need a browser fingerprintId.
Bootstrap, balance and reads wired. Bet placement is not live: the placebet endpoint exists but the betslip entry schema was never captured, so the gateway refuses to invent it.
SmartFoxServer request envelopes are built and test-matched, but the binary codec send path is not implemented — session reads work via app-config, bet fire raises a named gap.
Auth chain and history wired. The bet frame lives behind a successful authenticate and has never been observed, so it is not fabricated.
Launch chain and cookie session wired across all 205 Evolution apps. Bets are per-app socket messages (no single pinned frame yet) and balance is operator-side seamless, so balance/bet return gaps rather than guesses.
Blocked: the bet layer sits inside the VM-obfuscated "Astarte" bundle. Needs one runtime browser capture of a live session before anything can be wired honestly.
Blocked: the sample launch token was consumed server-side ("Unable to grab player"). Needs a fresh launch URL from the operator.
Blocked: server-side launcher only — the encrypted launch payload returns HTTP 500 from both egresses tried. Needs a fresh click-time launch URL.
Create a session from a launch URL, read balance and history, place a bet, cash out — the same five calls for every provider, translated into each provider's real protocol.
Payloads are reverse-engineered from the providers' own shipping clients and unit-tested against captured traffic — including ECDH → AES-GCM encrypted bet channels and socket hub protocols.
Bet and cashout requests are built and returned as receipts without being sent, unless the operator explicitly enables live fire in the aggregator admin. Nothing fires by accident.
Where the evidence runs out — an uncaptured betslip schema, an obfuscated bet layer — the API returns a named gap instead of a fabricated request. Statuses on this page are the real ones.
# 1. list providers
curl https://game.porq.site/api/v1/providers -H "x-api-key: YOUR_KEY"
# 2. open a session from an operator launch URL
curl -X POST https://game.porq.site/api/v1/creedroomz/session \
-H "x-api-key: YOUR_KEY" -H "content-type: application/json" \
-d '{"launchUrl":"https://…operator launch url…"}'
# 3. read the balance
curl "https://game.porq.site/api/v1/creedroomz/balance?session=creedroomz-1" \
-H "x-api-key: YOUR_KEY"Full reference, examples and error codes: API documentation.