Introduction

Welcome to the FireFlow API Documentation. Our platform enables tournament websites and mobile apps to fully automate Garena Free Fire custom room matches.

By connecting our API to your system, you can request custom rooms programmatically, and our automated emulator worker bots will configure the game client, create the room, return the credentials, and callback your system with parsed match scores once the match is completed.

Authentication

All public API requests must authenticate using your generated API key. You must include the API key in the request headers under the X-API-Key key.

X-API-Key: ff_live_84f932e650c82deacb68...

Create Match Request

To request a new automated custom room match, make a POST request to the match creation endpoint.

POST https://ff-api.jhxpro.shop/api.php?action=create_match

Headers

Content-Type: application/json
X-API-Key: YOUR_API_KEY

Request Body

{
  "map": "BERMUDA" // Optional. Options: BERMUDA, PURGATORY, KALAHARI, ALPINE
}

Response Example (200 OK)

{
  "success": true,
  "match_id": "match_91b1a45ee923d463",
  "status": "PENDING",
  "map": "BERMUDA",
  "message": "Match creation requested. Waiting for emulator worker bot."
}

Get Match Details

Use this endpoint to poll the status and retrieve Room ID / Password credentials for players once they are ready.

GET https://ff-api.jhxpro.shop/api.php?action=get_match&id={match_id}

Headers

X-API-Key: YOUR_API_KEY

Response Example (200 OK - Match is Active)

{
  "id": "match_91b1a45ee923d463",
  "status": "ACTIVE", // PENDING, CREATING, ACTIVE, COMPLETED
  "room_id": "9812543", // Free Fire Room ID
  "room_password": "123", // Custom Room Password
  "map": "BERMUDA",
  "results": null,
  "created_at": "2026-08-15 10:45:12",
  "updated_at": "2026-08-15 10:46:02"
}

Webhook Callbacks

Once a match is finished, our emulator bot captures the scoreboard, uses OCR to parse placements and kills, and sends a secure HTTP POST callback to your registered Webhook URL.

Callback Payload Format

{
  "event": "match.completed",
  "match_id": "match_91b1a45ee923d463",
  "room_id": "9812543",
  "map": "BERMUDA",
  "results": [
    { "name": "EagleEye_YT", "kills": 9, "rank": 1 },
    { "name": "DeltaForce", "kills": 5, "rank": 2 },
    { "name": "SniperKing", "kills": 3, "rank": 3 }
  ],
  "timestamp": 1786968002
}

Verify Webhook Signatures (Security)

To ensure callback requests are genuine and have not been spoofed by attackers to steal prize money, each request includes a digital signature in the X-SaaS-Signature header. The signature is computed using your Webhook Signing Secret and HMAC-SHA256.

const crypto = require('crypto');

// Express middleware example
app.post('/webhook', (req, res) => {
    const signature = req.headers['x-saas-signature'];
    const signingSecret = 'YOUR_WEBHOOK_SIGNING_SECRET';
    
    // Compute expected signature
    const computedSignature = crypto
        .createHmac('sha256', signingSecret)
        .update(JSON.stringify(req.body))
        .digest('hex');
        
    if (crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(computedSignature))) {
        // Request is authentic! Process scores
        const { results } = req.body;
        console.log("Verified match scores:", results);
        res.sendStatus(200);
    } else {
        // Invalid signature - Hacker detected!
        res.sendStatus(403);
    }
});

<?php
$headers = getallheaders();
$signature = isset($headers['X-SaaS-Signature']) ? $headers['X-SaaS-Signature'] : '';
$signingSecret = 'YOUR_WEBHOOK_SIGNING_SECRET';

$payload = file_get_contents('php://input');
$computedSignature = hash_hmac('sha256', $payload, $signingSecret);

if (hash_equals($computedSignature, $signature)) {
    // Request is authentic!
    $data = json_decode($payload, true);
    $results = $data['results'];
    // Update tournament database here
    http_response_code(200);
    echo "Webhook verified";
} else {
    // Spoofed request! Reject.
    http_response_code(403);
    echo "Signature verification failed";
}
?>

import hmac
import hashlib
from flask import Flask, request, abort

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-SaaS-Signature')
    signing_secret = b'YOUR_WEBHOOK_SIGNING_SECRET'
    
    payload = request.data
    computed_signature = hmac.new(
        signing_secret,
        payload,
        hashlib.sha256
    ).hexdigest()
    
    if hmac.compare_digest(computed_signature, signature):
        # Valid signature
        data = request.json
        results = data['results']
        return 'Success', 200
    else:
        # Spoofed request!
        abort(403)