Dodo Payments
A revenue dashboard for Dodo Payments
Dodo Payments has a real read-only mode. It is also the one provider here whose key gives away nothing about whether you used it, so this page is specific about what that means.
What connecting a Dodo Payments business gives you
Paylytics pulls payments, subscriptions, customers and products out of Dodo Payments and keeps its own copy. Every figure the dashboard draws is then a query against that copy rather than a request to Dodo Payments, which is what makes reading six businesss at once instant instead of six times slower than reading one.
It is a mirror, so it is only ever as current as the last refresh — and refreshing is a button, not a background job you have to trust. Nothing is written back to Dodo Payments at any point.
The key you create, and the box you have to leave unticked
Dodo's read-only mode is real, and it is a decision made once, when the key is created: leave "Enable write access" unchecked and the key genuinely cannot create or modify anything.
The prefix tells you which environment you are in rather than what the key may do — dodo_live_ and dodo_test_ are two different hosts, and Paylytics picks the right one from the key itself rather than asking you to configure it.
- Credential
- API key, beginning dodo_live_ or dodo_test_
- Where
- Developer, API keys
- The setting that matters
- "Enable write access", left unchecked
- What the prefix decides
- Live or test host — not permissions
What we cannot prove, and will not claim
A Dodo key created with write access enabled and one created without it are indistinguishable to anything holding the key. There is no prefix, no scope list and no endpoint that separates them.
So Paylytics can prove that what you pasted is a Dodo key, and no more than that. It says exactly that on the connect form rather than implying a guarantee it cannot make, and it does not close the gap by sending a deliberately invalid write to see what comes back. Unticking that box is the part that is genuinely yours to get right.
What Dodo reports, and how it is read
A refunded Dodo payment keeps a status of succeeded and carries the refund separately, as full or partial. Reading only the status files every refund as a plain sale; reading only the refund field counts failed payments as revenue. Both are read, which is why refunds show up here at all.
Two things Dodo cannot give us, stated rather than papered over. There is no account endpoint, so the business is identified through its brands — the business id, and the first brand's name as the label. And the payments list carries no product, so Dodo orders show no product name; products are mirrored as their own table instead of costing an extra request per order.
Partial refund amounts are not on the payment row either, so a partially refunded Dodo payment is marked as such without inventing a figure for how much came back.
Dodo Payments plus everything else you sell through
A Dodo Payments dashboard tells you about Dodo Payments. If you also take money somewhere else — a second Dodo Payments business, or an account at another provider entirely — nothing at Dodo Payments adds the two together, and nothing at the other provider does either.
Paylytics normalises every provider onto one shape at the point it reads them: amounts in minor units, one shared vocabulary for paid, refunded and partially refunded, one customer identified across accounts by a keyed fingerprint of their email rather than by the address itself. After that, merging is not a special case — a total across all 4 providers is the same query as a total across one.
Dodo Payments in more detail
- Several Dodo businesses, one totalDodo has two levels — the business and the brands inside it — and only one of them is the thing you connect.Read the guide
- A Dodo key that can only readThis is the one provider here where getting the key right is entirely your job, and this page is specific about why.Read the guide
The other providers
Connect any mix of them. A total across all 4 providers is the same query as a total across one.
Read-only, and nothing written back
Keys are encrypted before they touch the database and decrypted only to read. What that guarantee rests on differs per provider, and each page here says which.