One API from entry to claim: verification in front, a verifiable draw in the middle, and automation, webhooks and auditability behind it.
01
Catalog, drops, entries, wins, orders, notifications, subscriptions and webhooks are all resources on one versioned API, described in OpenAPI 3 with a generated TypeScript client.
The hosted storefront and admin portal use nothing you don’t get. Integrations authenticate with scoped API keys that carry a delegated subset of their owner’s permissions, are stored only as hashes and revoke at once. Every write is audited with who, what, when and from where.
Commit → draw → reveal
02
The seed is fixed before the entrant list is known, so anyone can check that the winners follow from it — without trusting you or us.
Every draw also persists a complete audit record — the entrant snapshot and the random value behind every pick. Draws are idempotent by design: a crashed draw re-executes to the same winners, never a second set.
03
A drop is only fair if one person cannot be ten accounts. Entering requires a phone number verified by a one-time SMS code, reserved to exactly one account per host.
The reservation is enforced by the database rather than by a lookup that can race. Flagged accounts can browse but never enter or claim, and a per-host blocklist refuses emails, phones and addresses at registration, entry and claim.
Normalised before comparison
The parts that turn a draw into a release your team can run.
Split winner slots across percentage pools with eligibility rules — reserve a share for verified users, an invite list, a region, or people who entered similar drops but never won. Entry rules use the same vocabulary to gate who may enter at all.
Loyal-but-unlucky entrants can receive bonus tickets that improve their odds without ever letting one person win more units than their entries allow.
Winning grants a time-boxed option to purchase, not an obligation. A declined or expired claim promotes the next standby by rank, who gets a window of their own — with no manual re-draw.
Sizes are variants of one item with their own stock. Opening is inventory-gated, a claim creates an order and decrements stock, and a cancellation restores it and releases the win.
Every lifecycle event and any resource change can reach your https endpoint as an HMAC-signed POST, with exponential backoff, at-least-once delivery and a stable id to de-duplicate on.
Secrets are derived rather than stored and rotate with a version bump. In-app notifications are pushed live over SignalR; email, SMS and push fan out per type with per-user preferences.
The hosted storefront is white-labelled from your branding — palette, logo and favicon, down to the transactional email — and localised for your customers. It is built entirely on the public API.
Prefer your own? Anonymous, rate-limited endpoints serve every launched drop, its details, masked results and the verifier, so a storefront has something to show before it has a single user.
A full admin portal covers the catalog, items and variants, the drop lifecycle, entrant and follower lists, exports, results and per-drop statistics — with staff interventions such as manual entries, disqualifications and closing early.
Multi-host and multi-tenant administration are built in, with permission-based access control, an entity event timeline, an operations snapshot of the background workers and per-host usage against your plan.
Authentication, resources, public endpoints, the webhook contract and draw verification — the developer overview.
Get a host provisioned, an API key issued and a webhook pointed at your stack — then run a real draw end to end.