Ship revenue features, not payment plumbing
A REST API with predictable JSON, Bearer keys, HMAC-signed webhooks and an instant sandbox. No SDK lock-in, no surprise objects, no pagination riddles.
# 1 · Who am I?
$ curl https://api.dorskopay.com/v1/me \
-H "Authorization: Bearer dsk_live_…"
# 2 · Create a product
$ curl -X POST https://api.dorskopay.com/v1/products \
-H "Authorization: Bearer dsk_live_…" \
-d name="Pro Plan" -d type=subscription
# 3 · Share the checkout URL. Done.
{ "checkout_url": "https://buy.dorskopay.com/checkout/price_8Xk2m" }
Scoped Bearer keys
Keys prefixed dsk_, hashed at rest, revocable instantly from the dashboard.
Idempotent writes
Retry any request safely. Duplicate orders are structurally impossible.
Signed webhooks
HMAC-SHA256 signatures with timestamps. Trust the event, not the network.
Predictable JSON
Flat objects, ISO 8601 dates, integer minor-unit amounts. No surprises.
API reference
v1 endpoints
Base URL https://api.dorskopay.com/v1 · authenticate with Authorization: Bearer dsk_…
/me
Identify the merchant behind the key — account, plan and commission terms
/products
List your products with their prices
/products
Create a product (one-time or subscription)
/products/{id}
Retrieve a single product
/products/{id}/prices
Add a price to a product — amount, currency, interval
/customers
List end customers who bought from you
/subscriptions
List active and past subscriptions
/transactions
List transactions with fees, tax and net amounts
/transactions/{reference}
Retrieve one transaction by its reference
Full request/response documentation and your keys live in the dashboard under Developers.
Webhooks
Events you can take to the bank
Register an endpoint and receive signed events for everything that matters — payments settling, subscriptions starting. Verify the Dorsko-Signature header and act with confidence.
transaction.completed
A payment settled — deliver the product, grant the license
subscription.created
A new subscription started — provision access
More event types roll out continuously — endpoints receive only what they subscribe to.
// Dorsko-Signature: t=1730000000,v1=5257a8…
[$t, $v1] = parse_header($_SERVER['HTTP_DORSKO_SIGNATURE']);
$expected = hash_hmac(
'sha256',
$t . '.' . file_get_contents('php://input'),
$endpoint_secret
);
if (hash_equals($expected, $v1)) {
// Trusted. Ship the goods.
}
Sandbox
Full platform, fake money, real webhooks.
Every account starts in a complete sandbox: simulated payments, live API, signed webhook deliveries. Integrate everything before a single real cent moves.
curl now,
scale later.
Your first API call is sixty seconds away. The rest of the platform will be there when you need it.
Free forever plan · Cancel anytime · Payouts in 24h