Store your API key in a server environment variable (.env) and inject it into the iframe src at render time. The key is never in source code or Git, and the game loads directly from the bet14 server — no resource issues. The key is visible in rendered HTML, but this is the industry-standard embed approach.
// appsettings.json (or env var Bet14ApiKey)
{ "Bet14ApiKey": "YOUR_API_KEY" }
// Pages/Game.cshtml.cs
public class GameModel : PageModel
{
public string EmbedUrl { get; private set; } = "";
private readonly IConfiguration _cfg;
public GameModel(IConfiguration cfg) => _cfg = cfg;
public IActionResult OnGet(string slug = "dragontiger")
{
var allowed = new[] { "dragontiger", "baccarat", "bigsixball" };
if (!allowed.Contains(slug)) slug = "dragontiger";
EmbedUrl = $"https://bet14mini.com/embed/{slug}/?key={_cfg["Bet14ApiKey"]}";
return Page();
}
}
// Pages/Game.cshtml
<iframe src="@Model.EmbedUrl"
style="width:100%;aspect-ratio:830/553;border:none"
allowfullscreen sandbox="allow-scripts allow-same-origin allow-popups"></iframe>
💡 Recommended ratio: 830 × 553 px — responsive: width:100%; aspect-ratio:830/553; border:none; 🔒 Keep the key only in .env and never commit it to Git. (Add .env to .gitignore)
Game Server Real-time API
Each game server exposes a state endpoint pollable every 300ms. Betting sites can consume this data to display the current round, phase, and card results in their own UI, or use it for payout calculations.
Endpoints
https://bet14mini.com/embed/{slug}/api/current ← Current round statehttps://bet14mini.com/embed/{slug}/api/results?limit=N ← Last N result history
No auth header required. The key is validated when the iframe loads; after that, the game server API can be called freely.
Common Response Fields
Field
Type
Description
round
integer
Global cumulative round number
daily_round
integer
Daily round number (for display)
date
string
Server date (YYYY-MM-DD)
phase
string
Current phase — see table below
remainMs
integer
Milliseconds remaining in current phase. Valid only during betting phase.
Never expose your API key publicly. If placed directly in client-side JavaScript it can be stolen.
The iframe embed URL (/embed/{slug}/?key=...) is used directly by the browser, so the key is visible. Generate the URL server-side.
One API key can embed multiple games simultaneously.
Renewing before expiry accumulates remaining days.
One API key allows up to 3 simultaneous sites. Opening multiple games on the same site still counts as one slot. If the same key is used on more than 3 different sites at once, new connections will be blocked.