Integration reference

Use a GET request to the result API. Domains must be exact registered hostnames; only HTTPS callback URLs are accepted. Game timers are 30 / 1 / 3 / 5.

GET https://aks-trend.in-999z.site/WinGoResultAPI.php?key=YOUR_KEY&callback_url=https%3A%2F%2Fabc.com&type=30&game=wingo

Signed mode is the default and requires ts, nonce, sig. HMAC input: key|type|issue|callback_url|ts|nonce (empty issue when omitted). Use your API key as HMAC-SHA256 secret; use 32-character lowercase hexadecimal random nonce; +/-120 seconds accepted; nonce is single-use.

Response: exactly one decimal digit with HTTP 200 when published. Missing/stale data: HTTP 503 with RESULT_UNAVAILABLE. Invalid key or domain: HTTP 403 with single character 0. Never interpret unauthorized 0 as a real draw: inspect status code and issue.

Sign server-to-server; do not embed API secrets in browser JavaScript. The callback_url hostname is a declared identity, NOT independent proof the caller controls the domain. The signed mode prevents ordinary replay/forgery without the key, but a leaked key can still be reused. Enforce caller outbound IP addresses using server-side infrastructure rules for high assurance.

Legacy mode can be enabled explicitly by the owner in config and per key to support older PHP cron clients, but offers weaker protections.