Financial infrastructure engineered for builders who live in code.
Ultra-low latency RESTful APIs (< 140ms), isolated environment keys (Sandbox & Production), guaranteed idempotency, and HMAC SHA-256 encrypted webhooks.
Integration in 3 Simple Steps
From your first cURL request to live production processing in under 5 minutes.
Bearer Authentication
Generate your secret key vk_test_* in the Dashboard. Pass it inside the Authorization: Bearer header on all HTTPS requests.
Create First Charge
Dispatch a JSON payload with method PIX or CREDIT_CARD and automated split rules to endpoint /api/v1/charges.
Receive HMAC Webhooks
Register your webhook listener URL. When the Central Bank settles the transaction, your system receives an event with a verifiable cryptographic signature SHA-256.
Bearer Token Authentication
The Dotfy API uses secret API keys to authenticate every request. Keys are prefixed with vk_test_ for test environments (Sandbox) and vk_live_ for live production.
Generates an instant dynamic Pix or tokenized Credit Card charge, with native support for atomic cascading split and white-label subaccounts.
Body Parameters (JSON)
| Field | Type | Requirement | Description |
|---|---|---|---|
| amount | integer | required | Charge amount in minor units / cents (e.g., 29700 for $297.00). |
| paymentMethod | string | required | Payment rail: PIX or CREDIT_CARD. |
| correlationID | string | required | Your internal order identifier for idempotent automated reconciliation. |
| split | array<object> | optional | List of split beneficiaries with recipientId and percentage. |
{
"amount": 29700,
"paymentMethod": "PIX",
"correlationID": "order_88921",
"customer": {
"name": "Guilherme Siqueira",
"email": "guilherme@enterprise.com",
"taxId": "23456789012"
},
"split": [
{ "recipientId": "rec_master_88", "percentage": 70 },
{ "recipientId": "rec_coprod_12", "percentage": 30 }
]
}Live Testing Playground
curl -X POST "https://api.dotfy.com.br/api/v1/charges" \
-H "Authorization: Bearer vk_test_sandbox_9921" \
-H "Content-Type: application/json" \
-d '{
"amount": 29700,
"paymentMethod": "PIX",
"correlationID": "order_88921"
}'Webhook Verification via HMAC SHA-256
To prevent spoofing or replay attacks, all webhook payloads include the X-Dotfy-Signature header containing the HMAC-SHA256 hash of the raw payload signed with your unique webhook secret.
const crypto = require('crypto');
function verifyWebhook(rawBody, signatureHeader, secret) {
const hmac = crypto.createHmac('sha256', secret);
const digest = hmac.update(rawBody).digest('hex');
return crypto.timingSafeEqual(Buffer.from(digest), Buffer.from(signatureHeader));
}