# Web Server Setup

> Set up a trusted backend to create gaming payment links and handle webhooks.

Source: https://help.boltapp.com/gaming/guide/web-server/setup

Your game needs a backend service to connect securely with the Bolt API. The web server is a trusted intermediary between your game client and Bolt.

## Requirements [#requirements]

Your web server should:

* **Authenticate with Bolt**: Use server-side API keys (never expose the signing secret in the client).
* **Create payment links**: Call `POST /v1/gaming/payment_links` on behalf of the game.
* **Persist transactions**: Store transaction data in your game schema.
* **Handle webhooks**: Accept transaction status updates from Bolt.
* **Validate authenticity**: Verify webhook signatures before fulfilling purchases.

## Payment link flow [#payment-link-flow]

The game requests a payment link from your web server. Your server calls `POST /v1/gaming/payment_links` and returns the `payment_link` URL to the client.

See [Create Payment Link](/gaming/guide/bolt-api/create-payment-link) for request and response details.

## Reference implementation [#reference-implementation]

* [Bolt Game Server Sample](https://github.com/BoltApp/bolt-gameserver-sample/tree/main): complete web server example
* [Demo storefront](https://gaming.staging-boltapp.com/store): try the checkout flow

## Related [#related]

* [Checkout quickstart](/gaming/guide/quickstart)
* [Validate webhooks](/gaming/guide/bolt-webhooks/validate-authenticity)