Idempotent orders
A repeated client_reference returns the existing order instead of charging twice.
API reference
Luban Play OpenAPI endpoints
Base URL: https://api.lubanplay.com. Every request requires an approved sandbox or production Bearer API key.
Authentication
Send the API key in the Authorization header.
Authorization: Bearer YOUR_API_KEY
Content-Type: application/jsonEndpoint directory
The paths below are relative to the production base URL.
| Method | Endpoint | Purpose |
|---|---|---|
| POST | /index.php?s=/api/openapi/balance | Return available wallet balances. |
| POST | /index.php?s=/api/openapi/products | Return enabled gift card products and SKUs. |
| POST | /index.php?s=/api/openapi/createOrder | Create a gift card order with an idempotent client reference. |
| POST | /index.php?s=/api/openapi/queryOrder | Query by Luban Play order ID or client reference. |
| POST | /index.php?s=/api/openapi/createBulkOrder | Accept up to 1,000 cards and return HTTP 202 with batch_id. |
| GET | /index.php?s=/api/openapi/queryBulkOrder | Return batch progress and chunk status. |
| GET | /index.php?s=/api/openapi/downloadBulkOrderCsv | Download currently delivered card codes. |
| POST | /index.php?s=/api/openapi/topupProducts | List enabled top-up games. |
| POST | /index.php?s=/api/openapi/topupPackages | List packages for a game. |
| POST | /index.php?s=/api/openapi/createTopupOrder | Create a player/account top-up order. |
| POST | /index.php?s=/api/openapi/queryTopupOrder | Query a top-up order. |
Idempotency and security
Use a unique client_reference for each intended order and verify webhooks before processing the payload.
IP whitelist
Production credentials can be restricted to approved source addresses.
Signed webhooks
Validate the X-Luban-Signature HMAC-SHA256 header against the raw payload.