Open Cases

Open cases on behalf of an authorized user using their token. Each spin is provably fair with HMAC-SHA256.

POST /api/oauth/cases/open

Request

fetch("https://omegacases.com/api/oauth/cases/open", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    token:       "user_token_here",
    client_seed: "optional-custom-seed"  // defaults to "omegacases"
  })
})

Success response

{
  "wonItem": {
    "id":           "uuid",
    "name":         "Dragon Claw",
    "image_url":    "https://...",
    "rarity":       "Legendary",
    "rap":          45.00,
    "market_price": 49.99
  },
  "cases_remaining":  12,
  "server_seed_hash": "sha256 hash shown before spin",
  "server_seed":      "revealed seed for verification",
  "client_seed":      "optional-custom-seed",
  "nonce":            0,
  "float":            0.4821903467
}

Error responses

{ "error": "Invalid or revoked token" }              // 401
{ "error": "Token does not have write_cases scope" }  // 403
{ "error": "No cases remaining" }                     // 402

Provably fair

Every spin uses HMAC-SHA256 with a server seed and client seed. You can verify any roll independently.

AlgorithmHMAC-SHA256(serverSeed, clientSeed:nonce:0) → first 8 hex chars as uint32 / 0x100000000

server_seed_hashSHA-256 of the server seed — commit shown before rolling

server_seedRevealed in the response so the roll can be independently verified

client_seedYour input — defaults to 'omegacases', override per request

Verify endpointGET /api/rolls/verify?id=roll_id — recomputes and confirms integrity

Verify a roll yourself

const hmac = createHmac("sha256", server_seed)
hmac.update(`${client_seed}:${nonce}:0`)
const hex   = hmac.digest("hex")
const float = parseInt(hex.slice(0, 8), 16) / 0x100000000
// float should match the float in the response