Integrate Trustly Scan and Pay

Trustly Scan and Pay enables real-time bank transfers in a physical gaming environment. It uses the Trustly Open Banking technology to provide instant funding directly from a customer bank account to a casino Electronic Gaming Machine (EGM). Funds are managed by the casino Cashless Wagering System (CWS), a component of the Casino Management System (CMS) or bridging technology, which governs the fund crediting process.

Trustly Scan and Pay streamlines the funding experience, reduces friction for customers, and accelerates cash flow.

Terminology

The following table lists the core terminology and acronyms used in a Trustly Scan and Pay integration.

Integrate Trustly Scan and Pay

Use the information provided to integrate the CMS or bridging technology with Trustly Scan and Pay. This allows players to fund gaming sessions using QR codes displayed on EGMs.

Implementation checklist

Use this checklist to confirm that all required tasks are complete for your Trustly Scan and Pay integration.

Roles and responsibilities

A successful Scan and Pay integration requires coordination between the CMS partner and Trustly. The following table details the specific ownership of tasks throughout the integration process.

Integration data flow

The following diagram illustrates the technical communication flow between the EGM, the CMS (or bridging technology), and the TPAS during a funding request.

%%{
  init: {
    'theme': 'base',
    'themeVariables': {
      'primaryColor': '#ffffff',
      'primaryTextColor': '#000000',
      'primaryBorderColor': '#000000',
      'lineColor': '#000000',
      'signalColor': '#000000',
      'signalTextColor': '#000000',
      'noteBkgColor': '#f4f4f4',
      'noteTextColor': '#000000',
      'noteBorderColor': '#000000',
      'actorBkg': '#ffffff',
      'actorBorder': '#000000',
      'actorTextColor': '#000000'
    }
  }
}%%
sequenceDiagram
    participant Player
    participant EGM
    participant CMS as CMS / Bridge
    participant Trustly as TPAS

    Player->>EGM: A;
    EGM->>CMS: B;
    CMS->>Trustly: C;
    Trustly-->>CMS: D;
    CMS-->>EGM: E;
    Note right of EGM: F;
    Player->>EGM: G;
    
    Note over Player, Trustly: H;
    
    Trustly->>CMS: I;
    Note right of CMS: J;
    CMS->>EGM: K;

Prerequisites

To support Trustly Scan and Pay transactions, the CMS or bridging technology must support specific functional capabilities. Additionally, you must provide API specifications to the Trustly integration team to enable the configuration of the Trustly Payment Agent Service (TPAS).

System capabilities

Your system must support the following functionality:

• QR Code Acquisition and Display: The system must be capable of requesting and displaying dynamic, time-sensitive QR codes on Electronic Gaming Machines (EGMs).
• Credit Application: The system must apply funds to the EGM credit meter immediately upon request from the TPAS and return the transaction status.
• Limit Enforcement: The system must create, modify, enforce, and delete debit instrument limits in compliance with applicable gaming regulations (such as Nevada Technical Standard 3.150). It must use the UBAI provided by the TPAS for limit tracking.

Documentation

You must provide comprehensive documentation for the following APIs to allow Trustly to configure the TPAS connection to your CMS or bridging technology:

• Funding API: Specifications must include full endpoint paths, JSON request and response schemas, error codes, timeout settings, IP whitelisting requirements, and authentication requirements (including token refresh procedures and Time-To-Live).
• Daily Limits API: Specifications must detail endpoints for getting, setting, updating, and deleting limits. It must also include logic for validating limits against the UBAI and specific error codes for scenarios such as Limit Reached.

Security and compliance

Trustly Scan and Pay meets the strict security and regulatory requirements of the gaming industry.

• PII isolation: The CMS or bridging technology does not process or store consumer Personally Identifiable Information (PII) during the funding flow. All banking authentication occurs directly between the user and their bank in the Trustly Microsite.
• Encryption: All API communication must occur over HTTPS using TLS 1.2 or higher.
• Tokenization: The UBAI allows the CMS to enforce limits without handling raw account numbers.
• QR Code Security: The rotation logic prevents replay attacks by invalidating QR codes shortly after generation.

Generate payment QR codes

Once Trustly has configured the TPAS for your environment, you will integrate with the QR Code API. Your system calls this endpoint to retrieve the secure URL that generates the QR code image.

API endpoint

Request

• Method: POST
• Content-Type: application/json
• Authorization: Basic Auth

Body parameters

Example request

curl -X POST https://cashlesscasino.sandbox.trustly.one/auth-service/api/oauth2/qrcode/token \
  -u "YOUR_ACCESS_ID:YOUR_ACCESS_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "asset": "EGM-Floor1-042",
    "merchantId": "123456789",
    "gameName": "Blackjack Video",
    "id": "PLAYER_998877"
  }'

Response

Example response

{
  "token": "w5wDqkdsJ4Ggl+UAvauF/fFv...",
  "expiresAt": "2025-01-01T17:00:00.0000",
  "url": "https://cashlesscasino.sandbox.trustly.one/cashlesscasino-client?token=w5wDqkdsJ4Ggl..."
}

Common error codes

EGM display implementation

The CMS is responsible for rendering the QR code on the EGM and managing its lifecycle.

QR code generation

1. Extract the url field from the API response.
2. Use a standard library to generate a QR Code image from the URL. The QR Code must meet the minimum size and contrast requirements to be easily scannable by standard mobile devices on the EGM display.

QR code rotation

To prevent replay attacks or the use of stale sessions, the QR code must auto-rotate before it expires.

1. Store the expiresAt timestamp from the API response.
2. Monitor the current time against this timestamp.
3. Initiate a request for a new QR code 10 seconds before the current expiresAt time. This buffer accounts for network latency and the time it takes a user to scan the code and load the page.
4. Replace the displayed image immediately upon receiving the new URL.

Test and validate

To allow Trustly to perform end-to-end (E2E) testing of the Trustly Scan and Pay integration, the CMS team must validate the following functionality:

• QR Code generates and displays correctly on the EGM
• The QR Code successfully opens the Trustly Microsite on a mobile device.
• The QR Code automatically refreshes ~10 seconds before expiration without manual intervention.
• Transactions respect the limits defined in the Daily Limits API. This is validated with the UBAI.
• The EGM handles API timeouts or failures. For example, hiding the QR code or showing a Service Unavailable message.