API Reference

View as Markdown

Authentication

Authenticate every request with a secret API key sent in the x-api-key header, from your server only.

Every Dolafy API request is authenticated with a secret API key. Dolafy resolves your organization from the key itself — you never pass an organization id.

API keys

Create and revoke keys from your dashboard under Developers → Keys. Keys look like this:

dlfy_live_<random_string>
  • The full key is shown only once, at creation time. Store it in your secrets manager immediately; Dolafy keeps only a hash and a short prefix for display.
  • Keys are scoped to your organization and to the products your organization has enabled.
  • Revoking a key takes effect immediately. Revoked keys fail authentication on the next request.

Sending the key

Pass your key in the x-api-key header on every request:

GET /v1/banking/balance
x-api-key: dlfy_live_...

Do not reuse internal or dashboard headers — x-api-key is the only accepted authentication header for the public API.

Call from your server

The API is designed to be called server-side:

  • Browser CORS is disabled by default. Origins are only allowlisted by arrangement with Dolafy, so a public web page cannot call the API directly.
  • Your API key is a secret. Never ship it in client-side code, mobile apps, or public repositories.
  • Allowlist your server IP. Ask your account manager to add your outbound server IP address(es) to your organization’s allowlist. Requests from unrecognized IPs may be blocked by Dolafy’s edge security before they reach the API.

Rate limits

Requests are rate limited per API key. The default authenticated limit is 600 requests per 15 minutes. Some sensitive endpoints (such as card issuance and card-details reads) have additional, stricter limits.

If you exceed a limit, back off and retry after a short delay.

Access control

An API key only works for a product while both of these are true:

  • Your organization has API access enabled.
  • Your organization has the specific product enabled (Banking, Cards, or Checkout).

If either is turned off, the relevant endpoints return a 403. See Errors & Idempotency for the exact codes.