Skip to main content

FAQ

Short answers to the questions that come up most during integration. Each entry links to the page that covers it in full.

I get a 403 when I open the system​

A 403 when loading the launch URL means we haven't enabled your iframe yet. This is expected, not a bug — the launch stays gated until we enable it.

Your login keeps working throughout and returns a valid token the whole time; only opening the system (the iframe) is gated. To clear the 403, implement your two webhooks (deposits and withdrawals), then run the Webhook Simulator until all four scenarios pass and notify us. Once you notify us, we enable your launch and it returns 200.

See Step 3 · Launch the system and the Integration overview for the full order.

Login returns 404 / "El Punto de Venta no existe..."​

A 404 from login means the affiliate_point_of_sale_id you sent doesn't exist or isn't assigned to your client. The API returns this exact message:

{
    "status": 404,
    "message": "El Punto de Venta no existe o no esta asignada al cliente enviado. Favor de contactar al administrador del sistema.[1018]"
}

Confirm the affiliate_point_of_sale_id value you're sending matches the one we provided with your credentials. If it still fails, contact us. See Step 1 · Login.

My signature doesn't match​

The #1 cause is hashing a re-serialized JSON body instead of the raw bytes as received. Re-serializing changes whitespace, key order, and number formatting (100.00 vs 100), and any of those changes the hash.

Hash the raw request body exactly as received, using SHA256(affiliate_username + raw_body + affiliate_username). See Signature for a worked example and validation code.

How long do you wait for my endpoint to respond?​

We wait up to 10 seconds for each webhook. Respond promptly — record the transaction and return one of the documented responses, and push any slower work off the request path. Keep the endpoint robust: on an internal error, still return the documented error body rather than letting the request hang. See Step 2 · Webhooks.

How long does the access token last?​

The access_token is a JWT valid for about 15 minutes. There is no refresh endpoint — when it expires, request a new token by logging in again, ideally right before launching. See Step 1 · Login.

Where do I get my hosts and credentials?​

We provide your credentials, along with the staging and production hosts, privately through a one-time link after your onboarding with Apuestería. They are not published in this documentation.

The link is single-use, so open it once and have somewhere ready to store the credentials securely. See Before you start.