DocCertify REST API

Authentication

Create keys in Settings → Developers. Send the key as a Bearer token. Test keys (dc_test_…) behave identically but issue watermarked test credentials that don't count against your plan and never email recipients. Perfect for integration testing.

Authorization: Bearer dc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Rate limit: 120 requests/min per key. Keys are stored hashed, so treat them like passwords.

Endpoints

curl -X POST https://doccertify.com/api/v1/credentials \
  -H "Authorization: Bearer dc_test_..." \
  -H "Content-Type: application/json" \
  -d '{
    "recipientName": "Jane Doe",
    "recipientEmail": "jane@example.com",
    "courseName": "Advanced Data Science",
    "expiryDate": "2028-07-17",
    "template": "classic",
    "customFields": [{ "label": "Grade", "value": "A+" }]
  }'

curl https://doccertify.com/api/v1/verify/AB12-CD34-EF56

Webhooks

Add HTTPS endpoints in Settings → Developers. We POST JSON events (currently credential.issued and credential.revoked), signed Stripe-style so you can verify authenticity.

X-DocCertify-Event: credential.issued
X-DocCertify-Signature: t=1789000000,v1=hex(hmac_sha256(secret, "{t}.{rawBody}"))

{
  "id": "evt_…",
  "type": "credential.issued",
  "created": "2026-07-17T10:00:00.000Z",
  "livemode": true,
  "data": {
    "object": "credential",
    "id": "…",
    "public_id": "AB12-CD34-EF56",
    "recipient_name": "Jane Doe",
    "verify_url": "https://doccertify.com/verify/AB12-CD34-EF56",
    "status": "active"
  }
}

Verify the signature (Node example):

import { createHmac, timingSafeEqual } from "crypto";

function verifySignature(header, rawBody, secret) {
  const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}