Fill the values once (saved in your browser), then run the checks. All requests go straight from your browser to the API — nothing is stored on a server.
The Smoke test sends a bogus bet_id; a 200 {status:false} proves auth + routing + JWT all work even without live game data.
Flow A works once the prefix is configured (PREFIX_TYPE=external, JWT_SECRET = your x-api-key) and your IP is allowed (or IP_WHITELIST empty). 401 = bad key · 403 = prefix not external / IP blocked · create-user & open-game may return 400 without a live provider-core (that's fine — auth still proven).
CORS: the worker allows cross-origin calls, so this page can call it directly. If you see a network/CORS error, confirm the Base URL is the deployed worker.
Flow B (real credit → customer wallet) can't run from this page. Use the standalone external-wallet-mock Node project to simulate the wallet, then trigger PG callbacks (see that project's README).