A provably fair result needs two secrets that neither side can control alone. Here is what each one is for, why the order matters, and how to check a round with the values you already have.
Cryptoflip generates a random server seed and shows you its SHA-256 hash before the round runs. A hash is one-way, so the hash tells you nothing about the seed itself, but it is a promise: once published, the seed behind it cannot be swapped for a different one without the hash changing. That is the whole point of showing it early. The house has committed to a value it can no longer move, and you are holding the receipt.
Your client seed goes into the same calculation. Because the server seed is fixed by its published hash and your seed is chosen independently, neither side can steer the outcome: the house cannot pick a seed to beat you, because its own is already committed, and you cannot pick one to beat the house, because you never see the server seed until the round is settled.
The same seed pair covers many rounds, so a counter goes into the hash as well. It increments every round, which is what stops two rounds with the same seeds producing the same result. Your next nonce is on screen while a seed pair is active, and it is part of what you paste in to verify.
The Original flip is SHA-256 of the server seed, the client seed, the nonce and a participants component made of both account ids. That fourth part is not decoration. Server seed, client seed and nonce are all fixed when a game is CREATED, so without it the outcome would be decided before anyone joined and would be identical whichever opponent accepted. Commit-reveal is unaffected: the house still cannot move the result, the creator still cannot precompute it, and a joiner cannot shop for a good one, because evaluating it needs a server seed nobody has yet.
The verifier on the Provably Fair page runs the same derivation the server runs, in your browser, using Web Crypto. It deliberately does not call our API, because a verification tool that asks the house for the answer verifies nothing at all. Paste in the revealed server seed, the client seed and the nonce from a settled round and you will get the result the round produced, or you will not.
The verifier recomputes a result in your browser from the seeds a settled round publishes. It never contacts our API, because a verification tool that asks the house for the answer verifies nothing.
The client seed is part of the pair shown on the game screen while it is active, and you can rotate the pair whenever you want. Rotating ends the current pair and starts a fresh one; it never changes a result that has already settled.
Because you could then compute the outcome in advance and only play the rounds that win. You see its hash instead, which is what stops the house changing the seed, and the seed itself is revealed once the round is settled so you can check it.
Then something is wrong and we want to know immediately. Every settled round is also replayed by an automated audit that recomputes the winner from the published seeds, so a mismatch would be caught on our side too, but a player-reported one should go straight to Support with the round id.