Pular para o conteúdo

Tap on Pix (NFC)

Tap on Pix lets the initiating institution start a Pix payment after reading a proximity (NFC) payload from the payer’s device or tag. The institution forwards that payload as-is into JSR (redirectless): either complete enrollment once or reuse an AUTHORISED enrollment and run Part 2 — Redirectless payment.

Tap to Pix URI (BCB pattern)

The NFC payload uses a URI shaped like:

pix://<hostname>?qr=<uri-encoded-emv-qr-string>&sig=<signature>

This is informational context — you don't need to take the URI apart yourself, but it helps to know what's inside it:

PartMeaning
<hostname>Domain identification for the party that published the QR Code.
<uri-encoded-emv-qr-string>Pix Copia e Cola content URI-encoded. The API decodes this parameter internally when you forward the full URL — no client-side decodeURIComponent() needed.
<signature>Optional, reserved for future use: signature of the decoded Copia e Cola using PS256, consistent with Open Finance practice. How the receiver obtains the public key for validation is not fixed in this documentation — follow institutional or regulator guidance when available.

Normative reference (Android proximity specification): BCB — Especificações Pix aproximação (PDF).

Processing on the institution side

  1. Read the NFC record and obtain the pix://… URI (and validate transport/security policies your product requires).
  2. Forward that URI as-is as payment.qrCode on Create payment consent — no need to parse qr/sig or decode anything yourself; the API identifies the Tap to Pix shape and parses it internally.
  3. If you adopt signature verification later, that's a check on your side against sig before forwarding — until PS256 and public-key distribution are defined for your integration, treat it as optional metadata.

JSR journey after NFC

No AUTHORISED enrollment yet

Run Part 1 — Enrollment from JSR (Redirectless): registered participants, create enrollment, bank redirect, fragment handling, FIDO2 registration, register device — until Get enrollment shows AUTHORISED.

Enrollment already AUTHORISED

Follow Part 2 — Redirectless payment in JSR (Redirectless):

  1. Call POST /api/v1/jsr/consents (Create payment consent) with enrollmentId and payment.qrCode set to the full pix://… URL exactly as received from the NFC read — sending only the decoded Copia e Cola also works, but it isn't required; the API parses the raw URL internally. There is no isNFC flag to send — the API resolves the flow purely from payment.qrCode being present.
  2. Complete navigator.credentials.get() using the returned fidoSignOptions and collect the assertion.
  3. Call POST /api/v1/jsr/payments (Authorise payment) with enrollmentId, the paymentRequestId (id) from step 1, riskSignals, and the fidoAssertion from step 2.
Tap on Pix — forward the raw NFC URI, enrollment gate, redirectless consent with qrCode
Tap on Pix — sequence from NFC tap through JSR consent and settlement

Prerequisites

Next steps