Developer information

Online Bingo API use

The Online Bingo API supports integrations that help people play and follow free community bingo games. Please use it thoughtfully, protect player data, and keep the service available for everyone.

Before you build

• This API is provided as-is for the free Online Bingo service; it is not an SLA or a guarantee of continued availability.
• There is not yet a versioned public API contract. Endpoints, fields, limits, and event formats may change.
• Do not build betting, wagering, paid-entry, prize, or gambling features around this service. The site itself does not provide them.
• Do not impersonate Online Bingo, a streamer, or another player, and do not use the API to harass, spam, or manipulate games.

Base URLs

REST:      https://bingoonline.3rd.zone/api
WebSocket: wss://bingoonline.3rd.zone/ws

Use HTTPS and WSS in production. JSON request and response bodies use UTF-8. Authenticated REST requests send the session token in the standard header:

Authorization: Bearer <session-token>

Authentication

Register with POST /auth/register or sign in with POST /auth/login. Both return a session token. Tokens expire after approximately 12 hours; integrations must handle expiration by asking the user to sign in again. Never put a token in a URL, log, analytics event, client error report, or public repository.

The health check GET /health is public. All player, streamer, and administrative data endpoints require authentication and are additionally checked against the caller's role and game access.

Supported capabilities

• Account access: register, sign in, and read the current user.
• Streamer discovery and favorites, including optional game-start email preferences.
• Streamer game management: create games, open or close registration, draw, pause, resume, complete, cancel, and archive.
• Player participation: join an open game, read owned cards, choose a dauber, mark or unmark cells, and submit claims.
• Game state: read calls, players, claims, and authorized game details.
• Real-time updates through /ws?token=<jwt>&gameId=<id>. The channel is read-only for clients; official draws and claim decisions must use REST.

Responsible use

• Use reasonable request rates, cache data where practical, and back off on errors. Do not poll aggressively or create unnecessary WebSocket connections.
• Do not scrape accounts, email addresses, player rosters, cards, or game data that the authenticated user is not authorized to see.
• Do not guess join codes, replay actions, bypass registration or approval rules, automate draws, or interfere with another game.
• Do not send unsolicited email or use Online Bingo data for advertising, profiling, resale, or unrelated marketing.
• Identify your integration with a descriptive user agent or contact method when practical, and keep a way to disable it quickly.

Privacy and data handling

Your integration must collect and retain only what it needs, secure credentials and tokens, honor deletion and unsubscribe requests, and follow applicable privacy and consumer-protection laws. Review our Terms of Service and privacy/data-use baseline before handling personal information or sending notifications.

Errors and changes

Treat non-2xx responses as failures and avoid automatic retry storms. A 401 means the session is missing or expired; 403 means the user is not allowed to perform the action; 404 means the resource or route was not found; and 400 generally indicates invalid input. We may throttle, suspend, revoke access, or change the API when an integration harms reliability, safety, fair play, or privacy.

Security reports

Do not test against real player accounts or active games without permission. Report suspected vulnerabilities privately to the site operator with the endpoint, time, reproduction steps, and impact. Do not publish sensitive details until the issue has been reviewed.