Skip to content
KrokoPay
Sign inCreate account

Developers

One request. Pix and card.

Create a charge with the methods you accept, send the customer to the hosted checkout and confirm payment with a signed webhook. Plain HTTP and JSON, with test keys from day one.

Get test keysStart with the quickstart

Test keys never move real money.

  • Provisional API proposal
  • No SDK published

API at a glance

Base URL
https://api.krokopay.app/v1
Version
2026-11-01
Authentication
Authorization: Bearer kp_test_sk_…
Test secret key
kp_test_sk_4f9a2c7e1b8d4a6f9c3e5d7b
Test publishable key
kp_test_pk_8b1d3f5a7c9e2b4d6f8a0c2e
Idempotency header
Idempotency-Key
Signature header
KrokoPay-Signature

Fictional test values. Your keys appear in the dashboard after sign-up.

One integration

Pix and card share one flow

There is no separate Pix integration. The methods field decides what the checkout offers, and the same events report the result.

  1. Create the charge

    POST /charges with the amount and methods: ["pix", "card"].

  2. Send to checkout

    Redirect to checkout_url. The customer picks Pix or card.

  3. Receive the event

    charge.paid or charge.failed arrives signed at your endpoint.

  4. Fulfill once

    Mark the order paid using the charge id, ignoring repeats.

POST /chargesbash
curl -X POST https://api.krokopay.app/v1/charges \  -H "Authorization: Bearer kp_test_sk_4f9a2c7e1b8d4a6f9c3e5d7b" \  -H "Idempotency-Key: order_1042" \  -H "Content-Type: application/json" \  -d '{    "amount": 49700,    "currency": "BRL",    "description": "Curso Identidade Visual do Zero",    "customer_id": "cus_8Hq2LmZr4TxN1a",    "methods": [      "pix",      "card"    ]  }'
The highlighted lines are the only difference between a Pix, a card or a Pix-and-card charge. Provisional API contract proposal — not an operational endpoint.

Try it

See the request and the response

Switch calls and languages. Every example runs against fictional data in the page: nothing is sent.

curl -X POST https://api.krokopay.app/v1/charges \  -H "Authorization: Bearer kp_test_sk_4f9a2c7e1b8d4a6f9c3e5d7b" \  -H "Idempotency-Key: order_1042" \  -H "Content-Type: application/json" \  -d '{    "amount": 49700,    "currency": "BRL",    "description": "Curso Identidade Visual do Zero",    "customer_id": "cus_8Hq2LmZr4TxN1a",    "methods": [      "pix",      "card"    ]  }'
ResponseJSON
{  "id": "chg_9Qs5MbT2kXn8Vd",  "object": "charge",  "amount": 49700,  "currency": "BRL",  "status": "pending",  "method": null,  "card": null,  "description": "Curso Identidade Visual do Zero",  "customer_id": "cus_8Hq2LmZr4TxN1a",  "product_id": "prod_3Vb7QpK9sWd2Ee",  "price_id": "price_5Kd1NcR8vYq3Hm",  "link_id": null,  "subscription_id": null,  "refunded_amount": 0,  "failure_code": null,  "created_at": "2026-11-03T18:40:00.000Z",  "paid_at": null,  "expires_at": null,  "available_at": null,  "checkout_url": "https://krokopay.app/pay/chg_9Qs5MbT2kXn8Vd"}

Press “Send test request” to simulate the customer paying and the charge.paid event arriving at your endpoint.

  • Provisional API contract proposal — not an operational endpoint.
  • Payloads abridged for this example.
  • Simulated in your browser. Nothing is sent over the network.

The building blocks

Built so a retry is never a second charge

Four things you can rely on when the network, the customer or your own server misbehaves.

Webhook deliveries

Watch every delivery arrive

The dashboard lists each event sent to your endpoint with its status and payload, so you can see what your server received and when.

  • Each delivery shows the event type, the HTTP status your server answered and the payload.
  • Failed deliveries are visible next to the successful ones.
  • How many times a failed delivery is retried is to be announced.
See the dashboard demo

Webhook deliveries

Endpointhttps://example.com/webhooks/krokopay

  • HTTP 200payout.paidpo_6Jm3XcV9qLs1NdAttempt 1Delivered02:00 PM
  • HTTP 200charge.failedchg_7Lc3PvN8yHd2WsAttempt 1Delivered01:02 PM
  • HTTP 200subscription.renewedsub_5Hn2RtK8wPz4BqAttempt 1Delivered12:00 PM
  • HTTP 200charge.paidRetrychg_9Qs5MbT2kXn8VdAttempt 2Delivered11:24 AM
  • HTTP 500charge.paidchg_9Qs5MbT2kXn8VdAttempt 1Failed11:23 AM
  • HTTP 200charge.createdchg_9Qs5MbT2kXn8VdAttempt 1Delivered11:21 AM

Times shown are demo values, not commercial terms.

Docs path

From first request to production-ready

Seven short guides, in the order you will need them.

  1. Step 1QuickstartA test charge end to end in a few minutes.
  2. Step 2AuthenticationSecret and publishable keys, and where each one goes.
  3. Step 3Creating chargesAmounts, methods and the checkout URL.
  4. Step 4WebhooksEndpoints, the event catalog and signature checks.
  5. Step 5IdempotencySafe retries for every write request.
  6. Step 6ErrorsThe error envelope and the failure codes.
  7. Step 7Test environmentTest keys, test cards and simulated Pix.

Where things stand

What exists today, and what does not

We would rather you plan with accurate expectations.

Available to explore

  • A documented API contract proposal: resources, events and error format.
  • cURL and fetch examples for every call on this page.
  • Fictional test keys and test cards to read the flows.

Not available

  • SDKs or packages: none are published. Use plain HTTP.
  • A stable contract: fields and codes may still change.
  • Final fees, payout timing and retry schedules: to be announced.
See what is provisional on pricing

Developer questions

Straight answers, including where the answer is not decided yet.

Building something specific?

See pricingTalk to us

No. No SDK or package is published. The API is plain HTTPS and JSON, so cURL, fetch or any HTTP client works.

Not yet. It is a provisional contract proposal. Resource names, fields and error codes may change before it is final, and the docs will note each change.

No. One charge request lists the methods you accept, the hosted checkout shows them, and the same charge.paid and charge.failed events report the result.

Each delivery is signed with your endpoint secret in the KrokoPay-Signature header. Verify it on the raw body before using the payload. The webhooks guide describes the proposed format.

The retry schedule is to be announced. Design your endpoint to be idempotent by storing the event id, so repeats are harmless whenever they happen.

Creating an account and exploring with test keys costs nothing. Live fees are to be announced on the pricing page.

Make your first test charge today

Sign up, copy your test keys and follow the quickstart. Nothing you do in test mode charges anyone.

Get test keysRead the quickstart