Launch checklist for a play-for-fun sportsbook: from sign-up to first bet

To start a sportsbook the play-for-fun way, you sign up for a platform, pick your sports and leagues, decide how players get free tokens, set stake limits, connect it to your site's login, tell players the rules, and run a soft launch before you announce it. This checklist walks through all 20 steps on The Sportsbook, from sign-up to the first real bet. Players bet free tokens, never real money, so there are no payments to set up; the work is in the rules, the integration and the community.

Account and sportsbook

1. Confirm you qualify, then sign up. The Sportsbook is for businesses and professional creators, 18+. Sign up (opens in a new tab) with an email and password or with Google, and verify your email with the 6-digit code. At sign-up you confirm you're 18 or older and acting for a business, and you accept the Terms, the Play-for-Fun Policy and the Data Processing Addendum. Read the Acceptable Use and Play-for-Fun Policy properly; most of this checklist comes from it. If the model itself is new to you, start with what a play-for-fun sportsbook is and come back.

2. Name the sportsbook, pick its primary sport and save the API key. The sportsbook starts on Free and nobody has to approve it. Your first API key (sbk_<prefix>_<secret>) is shown once. Put it straight into your server's secret store.

Sports, leagues and markets

3. Pick leagues one by one. Choose the leagues your audience actually follows from a catalog of more than a thousand. There's no "select all" on any plan, by design: a short list of leagues your players care about beats a long one they scroll past. Free allows up to three leagues; Custom starts at five per sport. A newly picked league starts showing its matches within about two minutes.

4. Review the markets for your sport. Each match page shows the full market list we carry for that match. If some markets don't suit your audience, hide them per sport in the console under Markets. This works on every plan.

Token label and token rules

5. Choose a token label. The label is the word shown next to amounts: TOKENS, COINS, POINTS or your community's own word, or no label at all. Currency symbols and codes ($, €, £, USD, BTC) aren't allowed, and a token amount should never be shown with a $.

6. Decide where tokens come from, and write it down. Tokens only come from free sources: an equal starting balance for every player, a free daily or weekly refill, and points for taking part (watch time, chat activity, completing a profile) at the same rate for everyone. Never for payments, subscriptions, donations, purchases or offer walls, and never converted from paid or redeemable points. Our guide to designing a free token economy covers sizing and seasons.

7. Wire the "Get more tokens" button to a free refill. When a player presses it, the SDK fires tokens-requested (onTokensRequested). Whatever your page opens must be free: no prices, no purchase, and never called a "deposit". Every player must always be able to get enough tokens to keep playing without paying.

Limits

8. Set stake limits and a maximum return. In the console, set the minimum stake, the maximum pre-match stake, the maximum live stake and the maximum return. Size them against your starting balance. If players start with 1,000 tokens and the maximum stake is 1,000, one bad bet empties a new account; a maximum of 100 keeps people playing through a whole matchday.

Integration

The step-by-step embed guide has the full code. These are the launch checks.

9. Keep the API key on your server. Environment variable or secret manager, never in the browser, a mobile app or a repository. Use one key per environment, and rotate by creating a new key, deploying it, then revoking the old one.

10. Open sessions from your server for the logged-in player. Your server calls POST /b2b/v1/sessions with a user_ref that you choose: a pseudonymous id of 1 to 128 characters, never an email or a real name. Never accept a user_ref from the browser.

curl -X POST https://api.thesportsbook.app/b2b/v1/sessions \  -H "Authorization: Bearer $SPORTSBOOK_API_KEY" \  -H "Content-Type: application/json" \  -d '{"user_ref": "viewer-42", "display_name": "Viewer 42", "locale": "en"}'

The launch_url in the response is single use and expires after 60 seconds, so create it right before rendering the page and never log, cache or reuse it. Exclude that page from any page cache. The player session it opens lasts 12 hours.

11. Mount the sportsbook and handle expired sessions. Two lines of HTML are enough to launch:

<div data-thesportsbook data-launch-url="LAUNCH_URL_FROM_YOUR_SERVER"></div><script src="https://play.thesportsbook.app/sdk.js"></script>

If you use the SDK with callbacks, set height: "auto" so the iframe follows its content, and handle session-expired: for expired, ask your server for a new session and pass it to updateToken(); for user_blocked, don't retry.

12. List your allowed origins. In Settings → Allowed origins, list every site that embeds the sportsbook as an exact origin (such as https://www.example.com, no paths or wildcards). Allowed origins govern browser API access. What protects your sportsbook is that only your server, with your API key, can open player sessions. If you listen to raw message events, check event.origin and event.source, and when posting to the iframe always pass the embed origin, never "*".

13. Never move tokens because of a browser event. Events like bet-placed are informational. Credit and debit tokens from your server through the API, with an idempotency_key on every call so a retry never moves tokens twice.

The full list is in the docs' security checklist (opens in a new tab).

Player disclosures and your player terms

14. Show the required disclosures before players first play. Section 8.1 of our policy requires you to tell players clearly, before they first play and in your terms for players, that:

• (a) the sportsbook is for entertainment only;
• (b) tokens have no monetary value;
• (c) tokens cannot be bought, sold, transferred, redeemed or exchanged for money, prizes or anything of value;
• (d) no real money can be staked or won;
• (e) players must be 18 or older, or older where local law requires; and
• (f) you, not The Sportsbook, run the sportsbook and its tokens.

Annex A of the policy gives short model text you can adapt, keeping its substance. It opens:

"[Sportsbook name] is a free play-for-fun game. [Token name] have no monetary value. They can't be bought, sold, transferred, redeemed or exchanged for money, prizes or anything else of value, and no real money can be staked or won. You must be 18 or older (or older, where the law where you live requires it) to play."

It goes on to say who runs the sportsbook, that odds and results may be delayed or wrong, that bets may be voided or re-settled, that a negative balance after a correction is never a debt, and that you're not affiliated with any league, team or event organizer.

15. Publish your player terms and privacy notice. Your terms must also prohibit transferring, selling or trading tokens and player accounts. Your privacy notice must tell players that a technology provider processes their data on your behalf. Our player notice template is a fuller model that covers both.

Age assurance and territories

16. Put age assurance in front of the sportsbook. Only people aged 18 or over may play (older where local law sets a higher age). Use age-assurance measures that suit your audience, and don't direct the sportsbook or its marketing at minors. What counts as appropriate depends on your audience and where they are.

17. Decide where you make it available. You must not offer the sportsbook where free-to-play simulated betting, or your particular use of it, is prohibited or needs authorization you don't hold. This is your responsibility as the operator, and we can't tell you what applies in each country. Check with a lawyer in your jurisdiction, and in the places where most of your players are.

Soft launch

18. Place test bets on a staff account. Use a real user_ref for a staff member, give it tokens, place a single and an accumulator, and watch them in the console under Bets. Follow a bet through settlement: most bets settle minutes after the final whistle; a few wait for official results or a check by our team.

19. Rehearse maintenance mode and blocking. Turn on maintenance mode with your own message and check what players see (betting pauses; the SDK emits maintenance). Then block the test player: open sessions end within about a second, and the embed tells the player the account is on hold. You'll use blocking for real, because our policy requires you to honor a player's request to stop playing by blocking them. Our back office guide covers both in more depth.

After launch

20. Watch monthly active players and plan your next step. A monthly active player is someone who opens a session in a calendar month, counted once. Free allows up to 250; over the cap, new players see a "full this month" screen while players who already played keep playing. When you're getting close, or when you want more sports, more leagues or live betting, move to Custom (up to 5,000 players, from $39 a month billed yearly at the time of writing, September 2026) or Full ($399 a month billed yearly, no cap under fair use). Upgrades are prorated. Current prices are on the pricing page, and how much a sportsbook costs compares the budgets in detail.

How to start a sportsbook: the checklist at a glance

Ready for step 1? Start free (opens in a new tab): the Free plan has everything you need to work through this list and place your first bet.

Frequently asked questions