Integration architecture

You integrate with Tanitar through four external surfaces:

flowchart LR
    BACK["Your backend"] -->|API key| API["Tanitar APIs"]
    BACK -->|Player-session credential + external Player id| SESSION["Create Player session"]
    SESSION -->|15-minute Player token| PLAYER["Your Player client"]
    ADMIN["Your administrators"] -->|organization session| DASH["Dashboard"]
    API -->|signed webhooks| BACK
    PLAYER --> API
    DASH --> API

What your integration must decideCopy Anchor Link

1. Which plane is calling. Backend automation uses an API key. Players use a Player context. Administrators use the dashboard. Credentials are not interchangeable.
2. How players are identified. Authenticate players in your own product. Your trusted backend asserts a stable external Player id with a dedicated Player-session credential; Tanitar resolves or creates the tenant-scoped mapping and returns a 15-minute Player token.
3. Which operations can be retried. Send an Idempotency-Key on routes that require one. Keep the same key and body when retrying the same logical operation.
4. How events reach your systems. Register a webhook endpoint, verify every signature, deduplicate on webhook-id, and return a success only after you have safely accepted the delivery.
5. How failures are handled. Use stable errorCode and requestId values. Retry only temporary failures, and recover dead deliveries through the dashboard or recovery API.

Platform guarantees that affect youCopy Anchor Link

• Tenant identity comes from the verified credential, never from a caller-supplied tenant field.
• Dedicated storage never falls back to shared storage when it is unavailable.
• Cross-service effects and webhooks are delivered at least once, so receivers must be idempotent.
• Authentication, scope, entitlement, rate and ownership checks fail closed.
• Secrets are shown once, stored as digests or encrypted values, and never returned in logs or error responses.

Continue readingCopy Anchor Link

• Multi-tenancy explains tenant selection and storage behavior.
• Delivery guarantees explains retries, deduplication and recovery.
• The governed request summarizes request checks and client-visible errors.
• Security and data handling lists the controls and responsibilities relevant to an integration.