Register

Live

POST/api/v1/auth/register

For registering a new member

Headers

Field	Type	Required	Description
Authorization	string	—	Not used — this endpoint is public; no member token required
X-Api-Key	string	Yes	Agent API key (ak_…) from the bo screen
X-Timestamp	string	Yes	Signing time in unix milliseconds (±300s skew allowed)
X-Nonce	string	Yes	Unique per-request value (UUIDv4) for replay protection
X-Signature	string	Yes	hex(HMAC-SHA256(secret, canonical)) — see the Authentication page
X-Player-IP	string	—	The player's real IP (IPv4/IPv6) — recommended (used in login history)
X-Player-UA	string	—	The player's User-Agent (optional — recorded in login history)
X-Request-Id	string	—	Your correlation id — echoed back as request_uuid (recommended)
x-lang	string	—	th (default) or en — the language of message

Request bodyapplication/json

Field	Type	Required	Description
phone	string	Yes	Member's Thai mobile number (0XXXXXXXXX, 10 digits) — one account per phone per agent
password	string	Yes	Password, 6-72 characters
full_name	string	—	Full name (max 100 characters) — should match the bank account name
bank	object	Yes	Bank details
└ bank_code	string	Yes	Canonical bank code, e.g. KBANK, SCB, BBL
└ account_number	string	Yes	Bank account number
└ account_name	string	Yes	First and last name
acquisition_channel	string	—	How the member found the site (dropdown on direct signup). If a referral link with its own channel is used, the link's value wins; omitted = DIRECTYOUTUBE \| FACEBOOK \| LINE \| TIKTOK \| GOOGLE \| INSTAGRAM \| TWITTER \| DIRECT \| BACKOFFICE \| OTHER
referral_code	string	—	Referral link code (?ref=<code>, max 32 chars). Invalid / inactive / wrong-agent codes are silently ignored — registration still succeeds

Request example

{
  "phone": "0812345678",
  "password": "P@ssw0rd123",
  "full_name": "สมชาย ใจดี",
  "bank": {
    "bank_code": "KBANK",
    "account_number": "1234567890",
    "account_name": "สมชาย ใจดี"
  },
  "acquisition_channel": "FACEBOOK",
  "referral_code": "AB12CD34"
}

Response

Fields in data

Field	Type	Required	Description
access_token	string	—	JWT to send as Authorization: Bearer — registering also logs the member in
expires_in	number	—	Access-token lifetime in seconds (900 = 15 minutes)
refresh_token	string	—	For requesting a new access token; valid 7 days
user	object	—	Summary of the new member
└ id	string	—	Member id (uuid)
└ username	string	—	Username (agent prefix + phone, lowercase, ≤20 chars)
└ role	string	—	RoleMEMBER
└ status	string	—	Account status — new signups are ACTIVE immediately
└ member_tier	string \| null	—	Member tier — starts at NEW
└ full_name	string \| null	—	Full name
└ selected_promotion_id	string \| null	—	Selected deposit bonus (null on a fresh signup)

Response example

{
  "success": true,
  "code": 0,
  "message": "สำเร็จ",
  "data": {
    "access_token": "eyJhbGciOiJIUzI1NiIs…",
    "expires_in": 900,
    "user": {
      "id": "0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0",
      "username": "abc0812345678",
      "role": "MEMBER",
      "status": "ACTIVE",
      "member_tier": "NEW",
      "full_name": "สมชาย ใจดี",
      "selected_promotion_id": null
    }
  },
  "request_uuid": "3c9d2f61-7b04-4e8a-9f27-1a5c8e0d4b72"
}

Possible error codes

code	Name	HTTP	Message
1004	USER_ALREADY_EXISTS	409	User already existsThis phone is already registered with this agent (duplicate username)
4001	VALIDATION_ERROR	400	Validation error
4002	BAD_REQUEST	400	Bad requestUnknown agent domain, or prefix+phone exceeds 20 characters
9003	TOO_MANY_REQUESTS	429	Too many requests. Please slow downAuth-group rate limit exceeded (10 req/min/IP)