Dokumentasi Teknis Solosmartpay

curl -X POST https://solosmartpay.com/v1/qris   -H "X-API-Token: ssp_live_xxxxxxxxxxxxxxxx"   -H "Idempotency-Key: order-123-quote"   -H "Content-Type: application/json"   -d '{
    "amount": 50000,
    "reference": "ORDER-123"
  }'

use Illuminate\Support\Facades\Http;

$response = Http::withHeaders([
    'X-API-Token' => config('services.solosmartpay.token'),
    'Idempotency-Key' => 'order-123-quote',
])->post('https://solosmartpay.com/v1/qris', [
    'amount'    => 50000,
    'reference' => 'ORDER-123',
]);

$quote = $response->throw()->json('data');
// Kirim quote_id dengan key baru untuk provisioning, lalu poll status_url.

const response = await fetch('https://solosmartpay.com/v1/qris', {
  method: 'POST',
  headers: {
    'X-API-Token': process.env.SSP_API_TOKEN,
    'Idempotency-Key': 'order-123-quote',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ amount: 50000, reference: 'ORDER-123' }),
});

const { data } = await response.json();
console.log('Total Bayar:', data.total_amount, 'Checkout URL:', data.checkout_url);

import os, requests

resp = requests.post(
    "https://solosmartpay.com/v1/qris",
    headers={"X-API-Token": os.environ["SSP_API_TOKEN"], "Idempotency-Key": "order-123-quote"},
    json={"amount": 50000, "reference": "ORDER-123"},
    timeout=10,
)
resp.raise_for_status()
data = resp.json()["data"]
print("Bayar tepat Rp", data["total_amount"], "di", data["checkout_url"])

body := strings.NewReader(`{"amount":50000,"reference":"ORDER-123"}`)
req, _ := http.NewRequest("POST", "https://solosmartpay.com/v1/qris", body)
req.Header.Set("X-API-Token", os.Getenv("SSP_API_TOKEN"))
req.Header.Set("Idempotency-Key", "order-123-quote")
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)

# 1. Ambil daftar metode pembayaran yang aktif untuk toko Anda
curl -X GET https://solosmartpay.com/v1/payment-methods   -H "X-API-Token: ssp_live_xxxxxxxxxxxxxxxx"

# 2. Buat tagihan Bank VA / E-Wallet / Retail (min. Rp 10.000)
curl -X POST https://solosmartpay.com/v1/payments   -H "X-API-Token: ssp_live_xxxxxxxxxxxxxxxx"   -H "Idempotency-Key: order-va-77-create"   -H "Content-Type: application/json"   -d '{
    "amount": 150000,
    "method": "BC",
    "reference": "ORDER-VA-77"
  }'

// Respons 202 Accepted:
{
  "data": {
    "id": "3c1f8a20-9b12-4e33-8a11-9c8b7a6f5e4d",
    "provisioning_status": "queued"
  },
  "status_url": "https://solosmartpay.com/v1/payments/3c1f8a20-9b12-4e33-8a11-9c8b7a6f5e4d"
}

$rawBody   = $request->getContent();
$timestamp = (string) $request->header('X-SoloSmartPay-Timestamp');
$signature = (string) $request->header('X-SoloSmartPay-Signature');
$eventId   = (string) $request->header('X-SoloSmartPay-Event-ID');

// 1. Tolak jika selisih waktu > 300 detik (mencegah replay attack)
if (abs(time() - (int) $timestamp) > 300) {
    abort(401, 'Timestamp expired');
}

// 2. Hitung ulang HMAC-SHA256 menggunakan signing secret webhook Anda
$expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, config('services.solosmartpay.webhook_secret'));

if (!hash_equals($expected, $signature)) {
    abort(401, 'Invalid webhook signature');
}

// 3. Deduplikasi berdasarkan $eventId, lalu tandai pesanan LUNAS
$event = json_decode($rawBody, true);
if (($event['type'] ?? '') === 'payment.paid') {
    Order::where('ref', $event['data']['reference'])->update(['status' => 'paid']);
}
return response()->json(['ok' => true]);

const crypto = require('crypto');

app.post('/webhook/solosmartpay', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.header('X-SoloSmartPay-Timestamp') || '';
  const signature = req.header('X-SoloSmartPay-Signature') || '';
  const rawBody   = req.body.toString('utf8');

  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(401).json({ error: 'Timestamp expired' });
  }

  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.SSP_WEBHOOK_SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  if (expected.length !== signature.length ||
      !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(rawBody);
  // event.type === 'payment.paid' → tandai pesanan event.data.reference lunas
  return res.status(200).json({ received: true });
});

import hmac, hashlib, time

def verify_webhook(raw_body: bytes, timestamp: str, signature: str, secret: str) -> bool:
    if abs(time.time() - int(timestamp)) > 300:
        return False
    signed_payload = timestamp.encode("utf-8") + b"." + raw_body
    expected = "sha256=" + hmac.new(secret.encode("utf-8"), signed_payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

mac := hmac.New(sha256.New, []byte(os.Getenv("SSP_WEBHOOK_SECRET")))
mac.Write([]byte(timestamp + "." + string(rawBody)))
expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
if !hmac.Equal([]byte(expected), []byte(signature)) {
    http.Error(w, "Invalid webhook signature", http.StatusUnauthorized)
    return
}