Exemplos de Conexão

curl --request GET \
  'https://api.delbank.com.br/baas/api/v1/balances' \
  --cert ./mtls/certificado.pem \
  --key ./mtls/chave-privada.key \
  --header "x-delbank-api-key: $DELFINANCE_API_KEY" \
  --header "x-delfinance-account-id: $DELFINANCE_ACCOUNT_ID"

import fs from "node:fs";
import https from "node:https";
import axios from "axios";

// Crie o agente uma única vez e reutilize: um agente por requisição
// refaz o handshake TLS e derruba a performance.
const httpsAgent = new https.Agent({
  cert: fs.readFileSync("./mtls/certificado.pem"),
  key: fs.readFileSync("./mtls/chave-privada.key"),
  minVersion: "TLSv1.2",
  keepAlive: true,
});

export const delfinance = axios.create({
  baseURL: "https://api.delbank.com.br",
  httpsAgent,
  timeout: 30000,
  headers: {
    "x-delbank-api-key": process.env.DELFINANCE_API_KEY,
    "x-delfinance-account-id": process.env.DELFINANCE_ACCOUNT_ID,
    "Content-Type": "application/json",
  },
});

const { data } = await delfinance.get("/baas/api/v1/balances");
console.log(data);

import os
import requests

# A Session mantém a conexão TLS aberta entre as chamadas.
session = requests.Session()
session.cert = ("mtls/certificado.pem", "mtls/chave-privada.key")
session.headers.update({
    "x-delbank-api-key": os.environ["DELFINANCE_API_KEY"],
    "x-delfinance-account-id": os.environ["DELFINANCE_ACCOUNT_ID"],
    "Content-Type": "application/json",
})

response = session.get(
    "https://api.delbank.com.br/baas/api/v1/balances",
    timeout=30,
)
response.raise_for_status()
print(response.json())

using System.Security.Cryptography.X509Certificates;

var certificate = X509Certificate2.CreateFromPemFile(
    "mtls/certificado.pem",
    "mtls/chave-privada.key");

// No Windows, o handler exige uma chave persistida. Reexportar como PFX
// resolve o erro "No credentials are available in the security package".
certificate = new X509Certificate2(certificate.Export(X509ContentType.Pfx));

var handler = new HttpClientHandler
{
    SslProtocols = System.Security.Authentication.SslProtocols.Tls12
                 | System.Security.Authentication.SslProtocols.Tls13,
};
handler.ClientCertificates.Add(certificate);

// Registre como singleton (IHttpClientFactory) em vez de instanciar por chamada.
var http = new HttpClient(handler)
{
    BaseAddress = new Uri("https://api.delbank.com.br"),
    Timeout = TimeSpan.FromSeconds(30),
};
http.DefaultRequestHeaders.Add(
    "x-delbank-api-key",
    Environment.GetEnvironmentVariable("DELFINANCE_API_KEY"));
http.DefaultRequestHeaders.Add(
    "x-delfinance-account-id",
    Environment.GetEnvironmentVariable("DELFINANCE_ACCOUNT_ID"));

var response = await http.GetAsync("/baas/api/v1/balances");
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

import okhttp3.*;

import javax.net.ssl.*;
import java.io.FileInputStream;
import java.security.KeyStore;

public class DelfinanceClient {

    public static void main(String[] args) throws Exception {
        char[] password = System.getenv("DELFINANCE_KEYSTORE_PASSWORD").toCharArray();

        // A JVM não lê o par .pem + .key diretamente: converta para PKCS#12 antes.
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        try (FileInputStream in = new FileInputStream("mtls/delfinance.p12")) {
            keyStore.load(in, password);
        }

        // KeyManager: apresenta o SEU certificado no handshake (é isso que faz o mTLS).
        KeyManagerFactory keyManagerFactory =
                KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, password);

        // TrustManager: valida o certificado do servidor com a truststore padrão da JVM.
        TrustManagerFactory trustManagerFactory =
                TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init((KeyStore) null);

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(
                keyManagerFactory.getKeyManagers(),
                trustManagerFactory.getTrustManagers(),
                null);

        OkHttpClient client = new OkHttpClient.Builder()
                .sslSocketFactory(
                        sslContext.getSocketFactory(),
                        (X509TrustManager) trustManagerFactory.getTrustManagers()[0])
                .build();

        Request request = new Request.Builder()
                .url("https://api.delbank.com.br/baas/api/v1/balances")
                .header("x-delbank-api-key", System.getenv("DELFINANCE_API_KEY"))
                .header("x-delfinance-account-id", System.getenv("DELFINANCE_ACCOUNT_ID"))
                .build();

        try (Response response = client.newCall(request).execute()) {
            if (!response.isSuccessful()) {
                throw new IllegalStateException("Falha na requisição: " + response);
            }
            System.out.println(response.body().string());
        }
    }
}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL            => 'https://api.delbank.com.br/baas/api/v1/balances',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 30,
    CURLOPT_HTTPHEADER     => [
        'x-delbank-api-key: ' . getenv('DELFINANCE_API_KEY'),
        'x-delfinance-account-id: ' . getenv('DELFINANCE_ACCOUNT_ID'),
        'Content-Type: application/json',
    ],
    CURLOPT_SSLCERT        => __DIR__ . '/mtls/certificado.pem',
    CURLOPT_SSLKEY         => __DIR__ . '/mtls/chave-privada.key',
    CURLOPT_SSL_VERIFYPEER => true,
    CURLOPT_SSL_VERIFYHOST => 2,
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException('Erro cURL: ' . curl_error($curl));
}

$status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($status < 200 || $status >= 300) {
    throw new RuntimeException("HTTP {$status}: {$response}");
}

echo $response;

package main

import (
	"crypto/tls"
	"fmt"
	"io"
	"net/http"
	"os"
	"time"
)

func main() {
	cert, err := tls.LoadX509KeyPair("mtls/certificado.pem", "mtls/chave-privada.key")
	if err != nil {
		panic(err)
	}

	// Reutilize o client: ele mantém o pool de conexões TLS.
	client := &http.Client{
		Timeout: 30 * time.Second,
		Transport: &http.Transport{
			TLSClientConfig: &tls.Config{
				Certificates: []tls.Certificate{cert},
				MinVersion:   tls.VersionTLS12,
			},
		},
	}

	req, err := http.NewRequest(
		http.MethodGet,
		"https://api.delbank.com.br/baas/api/v1/balances",
		nil,
	)
	if err != nil {
		panic(err)
	}
	req.Header.Set("x-delbank-api-key", os.Getenv("DELFINANCE_API_KEY"))
	req.Header.Set("x-delfinance-account-id", os.Getenv("DELFINANCE_ACCOUNT_ID"))

	resp, err := client.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(body))
}