Documentação
LofyPay

{
  "api-key": "sk_test_…",
  "idTransaction": "52fc5262-…",
  "status": "paid"
}

{
  "event": "pix.paid",
  "environment": "test",
  "test": true,
  "idTransaction": "52fc5262-…",
  "externalReference": "PEDIDO-123456",
  "status": "paid"
}

curl -X POST https://app.lofypay.com/api/v1/gateway \
  -H "Authorization: Bearer sk_live_…sua_secret_key…" \
  -H "Content-Type: application/json" \
  -d '{ "amount": 100.50, "method": "pix", "client": { "name": "Pedro", "document": "12345678900" } }'

{
  "api-key": "sk_live_…sua_secret_key…",
  "amount": 100.50
}

{
  "api-key": "sk_live_…",
  "amount": 100.50,
  "method": "pix",
  "external_reference": "PEDIDO-123456",
  "notification_url": "https://seu-site.com/webhook",
  "client": {
    "name": "Pedro H. Santos",
    "document": "12345678900",
    "email": "pedro@exemplo.com"
  },
  "split": {
    "percentual": 10,
    "destino": "100042"
  }
}

curl -X POST https://app.lofypay.com/api/v1/gateway \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 100.50,
    "method": "pix",
    "external_reference": "PEDIDO-123456",
    "client": {
      "name": "Pedro H. Santos",
      "document": "12345678900",
      "email": "pedro@exemplo.com"
    }
  }'

const res = await fetch("https://app.lofypay.com/api/v1/gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": `Bearer ${process.env.LOFYPAY_SECRET}`,
  },
  body: JSON.stringify({
    amount: 100.50,
    method: "pix",
    external_reference: "PEDIDO-123456",
    client: {
      name: "Pedro H. Santos",
      document: "12345678900",
      email: "pedro@exemplo.com",
    },
  }),
});

const data = await res.json();
// data.idTransaction, data.paymentCode (e data.paymentCodeBase64, quando disponível)

{
  "status": "success",
  "paymentCode": "00020126580014br.gov.bcb.pix0136123e4567-…",
  "idTransaction": "52fc5262-4063-4900-933b-55e6985096a1",
  "paymentCodeBase64": "iVBORw0KGgoAAAANSUhEUgAA…",
  "environment": "live"
}

{
  "idtransaction": "52fc5262-4063-4900-933b-55e6985096a1"
}

{
  "status": "PAID_OUT"
}

{
  "status": "PAID",
  "idTransaction": "52fc5262-4063-4900-933b-55e6985096a1",
  "amount": 100.50,
  "external_reference": "PEDIDO-123456",
  "paid_at": "2026-05-20 14:30:12"
}

import { createHmac, timingSafeEqual } from "node:crypto";

// secret = o secret do endpoint cadastrado em /gateway
function verifyLofypay(rawBody, secret, sigHeader, toleranceSec = 300) {
  // sigHeader = "t=1730475012,v1=9f3c…"
  const parts = Object.fromEntries(
    sigHeader.split(",").map((kv) => {
      const i = kv.indexOf("=");
      return [kv.slice(0, i).trim(), kv.slice(i + 1).trim()];
    })
  );
  const t = Number(parts.t);
  if (!Number.isFinite(t)) return false;

  // 1) Anti-replay: recusa eventos fora da janela (relógio do seu servidor).
  if (Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;

  // 2) Assinatura: HMAC de `${t}.${rawBody}` (use o corpo CRU, sem reparsear).
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1 || "", "hex");
  return a.length === b.length && timingSafeEqual(a, b); // timing-safe
}

{
  "event": "med.opened",
  "sent_at": "2026-06-01T14:30:12.000Z",
  "data": {
    "med_case_id": 482,
    "provider": "onlyup",
    "provider_case_id": "infra_9f3c…",
    "type": "FRAUD",
    "reason": "ACCOUNT_HOLDER",
    "status": "pending_institution",
    "status_label": "Aguardando Instituição",
    "resolution": null,
    "amount": 150.00,
    "transaction": {
      "idTransaction": "52fc5262-4063-4900-933b-55e6985096a1",
      "external_reference": "PEDIDO-123456"
    },
    "opened_at": "2026-06-01T14:29:50.000Z",
    "due_at": "2026-06-06T14:29:50.000Z"
  }
}

{
  "amount": 50.00,
  "name": "Favorecido da Silva",
  "cpf": "12345678900",
  "keypix": "favorecido@exemplo.com",
  "tipo_chave": "EMAIL"
}

curl -X POST https://app.lofypay.com/api/v1/cashout \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 50.00,
    "name": "Favorecido da Silva",
    "cpf": "12345678900",
    "keypix": "favorecido@exemplo.com",
    "tipo_chave": "EMAIL"
  }'

{
  "success": true,
  "code": "SUCCESS",
  "message": "…",
  "retryable": false,
  "status": "PROCESSING",
  "withdrawalId": 1234,
  "id": 1234
}

{
  "success": false,
  "code": "PROVIDER_REJECTED",
  "message": "…",
  "retryable": false,
  "status": "REJECTED",
  "id": 1234
}

{
  "ok": true
}

const res = await fetch("https://app.lofypay.com/api/health");
const { ok } = await res.json();
console.log(ok ? "API Online" : "API Offline");

{
  "status": "error",
  "message": "API key rate limit exceeded"
}