dLocal
dLocal is an enterprise emerging-market payment processing platform that connects global merchants to local payment methods across 40+ countries in Latin America, Africa, and Asia-Pacific using HMAC-signed REST API requests.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
HMAC-SHA256 per-request signing is strong but operationally complex; the requirement to include a timestamp in the signature prevents replay attacks effectively.
⚡ Reliability
Best When
A global enterprise needs to accept or disburse payments across multiple emerging markets with a single API contract, compliance support, and dedicated account management.
Avoid When
You are a small or mid-sized business without enterprise volume or need self-serve API access without a sales process.
Use Cases
- • Accept local payment methods (Boleto, PIX, OXXO, M-Pesa) from a single integration for multi-country LatAm/Africa expansion
- • Initiate cross-border payouts to local bank accounts or mobile wallets in emerging markets for global payroll or marketplace disbursements
- • Tokenize cards from emerging-market issuers that are declined by global gateways for recurring billing
- • Query settlement and reconciliation reports via API to feed financial systems with multi-currency transaction data
- • Process installment payments (parcelamento) for Brazilian e-commerce where card installments are a customer expectation
Not For
- • Startups or small merchants — dLocal targets enterprise customers with significant transaction volume minimums
- • Rapid self-serve API integration — onboarding requires sales engagement and contract negotiation
- • Domestic-only payment processing in developed markets where Stripe or Adyen is more cost-effective
Interface
Authentication
HMAC-SHA256 signed requests using X-Date, X-Login, X-Trans-Key, and Authorization headers. Each request requires a timestamp, computed signature over the request body, and unique transaction key — more complex than Bearer token auth.
Pricing
Pricing is fully negotiated at contract time. No public rate card. Volume commitments typically expected.
Agent Metadata
Known Gotchas
- ⚠ HMAC signature must be computed per-request including the current UTC timestamp — clock skew beyond 5 minutes causes authentication failures
- ⚠ Payment method availability varies by country within the same API — always query the /payments-methods endpoint for the target country before presenting options
- ⚠ Boleto and OXXO payments are cash-based with multi-day settlement — agents must listen for the payment.completed webhook, not the initial payment creation response
- ⚠ Test environment credentials are entirely separate from production and require specific sandbox setup through the account team
- ⚠ Currency conversion is handled server-side; agents cannot set the settlement currency independently of the payment currency without explicit contract configuration
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for dLocal.
Scores are editorial opinions as of 2026-03-06.