Skip to content
Bookmaker Docs

Changelog

The integration follows the versioning policy: compatible additions within a version, a new SDK URL for breaking changes.

v1 · 2026-10-16

Section titled “v1 · 2026-10-16”

First public version of the iframe integration.

API

  • POST /api/v1/integration/sessions also returns launchToken (single use, 120 seconds), launchExpiresAt and launchUrl, and accepts path and locale for the launch URL.
  • New POST /api/v1/integration/launch: exchanges a launch token once for the session token. Refusals carry details.reason: launch_token_invalid, launch_token_used, launch_token_expired.
  • GET /api/v1/config exposes tenant.embedOrigins.
  • Sportsbook pages carry Content-Security-Policy: frame-ancestors from the tenant’s embedOrigins.

Embed SDK

  • /embed/v1.js (global BookmakerSportsbook) and @bookmaker/embed-sdk (ES module with types): mount() with launch tokens, auto and fill sizing, deep links, locale, every event as a callback and every command as a method; origin checks on every message.

postMessage protocol v1

  • Events: ready, resize, route, login_required, session_expired, balance_changed, bet_placed, bet_settled, deposit_requested, error.
  • Commands: set_launch_token, navigate, set_locale, refresh_balance, logout.

Deprecated

  • Launching with the session token in the URL (?token=). It keeps working; move to ?launch= or the SDK.