Bem-vindo à API da TrevoPay

// amount em CENTAVOS (int): 1990 = R$ 19,90
trevopay.charges.create({
  amount: 1990,
  description: 'Curso de PIX',
  externalId: 'PED-123',
});

curl -X POST https://api.treevopay.com/sandbox/simulate-payment/ch_xxx \
  -H "Authorization: Bearer sk_test_SUA_CHAVE"

curl -X POST https://api.treevopay.com/v1/charges \
  -H "Authorization: Bearer sk_test_SUA_CHAVE" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: pedido-123" \
  -d '{"amount":1990,"description":"Curso","externalId":"PED-123"}'

<?php
$ch = curl_init('https://api.treevopay.com/v1/charges');
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_POST           => true,
  CURLOPT_HTTPHEADER     => [
    'Authorization: Bearer sk_test_SUA_CHAVE',
    'Content-Type: application/json',
    'Idempotency-Key: pedido-123',
  ],
  CURLOPT_POSTFIELDS     => json_encode([
    'amount'      => 1990,
    'description' => 'Curso',
    'externalId'  => 'PED-123',
  ]),
]);
$res = json_decode(curl_exec($ch), true);
echo $res['data']['brCode'];

const res = await fetch('https://api.treevopay.com/v1/charges', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sk_test_SUA_CHAVE',
    'Content-Type':  'application/json',
    'Idempotency-Key': 'pedido-123',
  },
  body: JSON.stringify({
    amount: 1990,
    description: 'Curso',
    externalId: 'PED-123',
  }),
});
const { data, error } = await res.json();
if (error) throw new Error(error.message);
console.log(data.brCode);

import requests

resp = requests.post(
    'https://api.treevopay.com/v1/charges',
    headers={
        'Authorization': 'Bearer sk_test_SUA_CHAVE',
        'Content-Type':  'application/json',
        'Idempotency-Key': 'pedido-123',
    },
    json={
        'amount': 1990,
        'description': 'Curso',
        'externalId': 'PED-123',
    },
    timeout=15,
)
resp.raise_for_status()
print(resp.json()['data']['brCode'])

{
    "success": true,
    "data": {
        "id": "ch_2f1a8c9d4e5b6a7c8d9e0f12",
        "amount": 1990,
        "currency": "BRL",
        "status": "pending",
        "description": "Curso",
        "externalId": "PED-123",
        "brCode": "00020101…6304ABCD",
        "brCodeBase64": "data:image/png;base64,iVBOR…",
        "expiresAt": "2026-05-29T14:00:00Z",
        "mode": "test"
    },
    "error": null
}

curl https://api.treevopay.com/v1/charges/ch_xxx \
  -H "Authorization: Bearer sk_test_SUA_CHAVE"

curl -X POST https://api.treevopay.com/v1/cashouts \
  -H "Authorization: Bearer sk_live_SUA_CHAVE" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: saque-afiliado-789" \
  -d '{
    "amount": 50000,
    "pixKey": "joao@exemplo.com",
    "pixKeyType": "email",
    "externalId": "PAYOUT-789",
    "description": "Comissao afiliado"
  }'

{
    "success": true,
    "data": {
        "id": "bp_co_a1b2c3d4e5f6a7b8",
        "amount": 50000,
        "currency": "BRL",
        "status": "pending",
        "externalId": "PAYOUT-789",
        "transactionId": "TXN-PSP-99887766",
        "pixKey": "joao@exemplo.com",
        "pixKeyType": "email",
        "description": "Comissao afiliado",
        "failureReason": null,
        "mode": "live",
        "requestedAt": "2026-05-29T14:00:00Z",
        "confirmedAt": null
    },
    "error": null
}

curl https://api.treevopay.com/v1/cashouts/bp_co_xxx \
  -H "Authorization: Bearer sk_live_SUA_CHAVE"

<?php
$secret = 'whsec_SEU_SIGNING_SECRET';
$body = file_get_contents('php://input');
$ts  = $_SERVER['HTTP_X_TREVO_TIMESTAMP'] ?? '';
$sig = $_SERVER['HTTP_X_TREVO_SIGNATURE'] ?? '';

// rejeita replay (> 5 min)
if (abs(time() - (int)$ts) > 300) { http_response_code(400); exit; }

$expected = hash_hmac('sha256', $ts . '.' . $body, $secret);
if (!hash_equals($expected, $sig)) { http_response_code(401); exit; }

$evt = json_decode($body, true);
// libere o acesso do cliente aqui — $evt['data']['externalId'] etc.
http_response_code(200);

const crypto = require('crypto');

function verifyWebhook(req, secret) {
  const ts  = req.headers['x-trevo-timestamp'] || '';
  const sig = req.headers['x-trevo-signature'] || '';
  const raw = req.rawBody;            // string crua, NAO o JSON parseado

  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const expected = crypto.createHmac('sha256', secret)
                         .update(`${ts}.${raw}`)
                         .digest('hex');

  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(sig, 'hex');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hmac, hashlib, time

def verify_webhook(headers, raw_body: bytes, secret: str) -> bool:
    ts  = headers.get('X-Trevo-Timestamp', '')
    sig = headers.get('X-Trevo-Signature', '')
    if not ts.isdigit() or abs(time.time() - int(ts)) > 300:
        return False
    msg = f"{ts}.{raw_body.decode('utf-8')}".encode('utf-8')
    expected = hmac.new(secret.encode('utf-8'), msg, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)