Dokumentasi API

curl -X POST https://streadpay.com/v1/payments \
  -H "Authorization: Bearer str_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"amount": 10000, "merchant_ref": "ORDER-1029"}'

Authorization: Bearer str_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Idempotency-Key: ORDER-1029

{ "success": true, "data": { } }

{ "success": false, "error": { "code": "MIN_AMOUNT", "message": "Minimal transaksi Rp1.000." } }

{
  "success": true,
  "data": [ ],
  "pagination": { "page": 1, "limit": 20, "total": 158, "pages": 8 }
}

{
  "amount": 10000,
  "merchant_ref": "ORDER-1029",
  "description": "Topup 100 diamond",
  "metadata": { "telegram_user_id": 123456789 }
}

{
  "success": true,
  "data": {
    "id": "pay_8fKq2LmZx01aB9cD",
    "invoice_id": "INV-20261031-7KQ2XM",
    "merchant_ref": "ORDER-1029",
    "status": "PENDING",
    "amount": 10000,
    "fee": 170,
    "unique_code": 32,
    "total_amount": 10202,
    "net_amount": 10000,
    "fee_bearer": "customer",
    "description": "Topup 100 diamond",
    "qr_string": "00020101021226670016COM.NOBUBANK.WWW...",
    "qr_image_url": "https://streadpay.com/pay/pay_8fKq2LmZx01aB9cD/qr.png",
    "pay_url": "https://streadpay.com/pay/pay_8fKq2LmZx01aB9cD",
    "expires_at": "2026-10-31T15:30:00Z",
    "paid_at": null,
    "created_at": "2026-10-31T15:00:00Z",
    "metadata": { "telegram_user_id": 123456789 }
  }
}

curl https://streadpay.com/v1/payments/pay_8fKq2LmZx01aB9cD \
  -H "Authorization: Bearer str_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

{
  "success": true,
  "data": { "available": 2440256, "pending": 98000, "reserved": 0 }
}

{
  "id": 1042,
  "type": "payment_credit",
  "amount": 10000,
  "balance_after": 2440256,
  "reference": "pay_8fKq2LmZx01aB9cD",
  "description": "Pembayaran QRIS INV-20261031-7KQ2XM",
  "created_at": "2026-10-31T15:02:11Z"
}

{
  "success": true,
  "data": {
    "id": "wd_Qm81ZpXc0LkT4rAa",
    "status": "REQUESTED",
    "amount": 100000,
    "fee": 2500,
    "net": 97500,
    "bank": { "bank_code": "BCA", "account_no": "******7890", "account_name": "Budi Santoso" },
    "created_at": "2026-10-31T15:10:00Z"
  }
}

{
  "id": "evt_Zt4kP0mQ2wX8nB1c",
  "event": "payment.paid",
  "mode": "live",
  "created_at": "2026-10-31T15:02:11Z",
  "data": {
    "id": "pay_8fKq2LmZx01aB9cD",
    "invoice_id": "INV-20261031-7KQ2XM",
    "merchant_ref": "ORDER-1029",
    "status": "PAID",
    "amount": 10000,
    "total_amount": 10202,
    "net_amount": 10000,
    "paid_at": "2026-10-31T15:02:09Z",
    "metadata": { "telegram_user_id": 123456789 }
  }
}

// npm install express
const express = require('express');
const crypto = require('crypto');

const API = 'https://streadpay.com/v1';
const KEY = process.env.STREADPAY_API_KEY;
const SECRET = process.env.STREADPAY_WEBHOOK_SECRET;

// Buat tagihan. Panggil saat pembeli checkout / mengetik perintah beli di bot.
async function createPayment(orderId, amount, metadata = {}) {
  const res = await fetch(`${API}/payments`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${KEY}`,
      'Content-Type': 'application/json',
      'Idempotency-Key': orderId,
    },
    body: JSON.stringify({ amount, merchant_ref: orderId, metadata }),
  });
  const json = await res.json();
  if (!json.success) throw new Error(`${json.error.code}: ${json.error.message}`);
  return json.data; // kirim data.qr_image_url atau data.pay_url ke pembeli
}

const app = express();

// Webhook: pakai express.raw agar signature dihitung dari body asli.
app.post('/webhook/streadpay', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.get('X-StreadPay-Timestamp');
  const signature = (req.get('X-StreadPay-Signature') || '').replace('sha256=', '');
  const expected = crypto.createHmac('sha256', SECRET).update(`${timestamp}.${req.body}`).digest('hex');

  const valid = signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) < 300;
  if (!valid || !fresh) return res.status(401).end();

  res.sendStatus(200); // balas dulu, proses setelahnya

  const event = JSON.parse(req.body);
  if (event.event === 'payment.paid') {
    // TODO: cek event.id belum pernah diproses, lalu tandai pesanan lunas
    console.log('Lunas:', event.data.merchant_ref, event.data.amount);
  }
});

app.listen(3000);

<?php
// Buat tagihan
function createPayment(string $orderId, int $amount): array {
    $ch = curl_init('https://streadpay.com/v1/payments');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => [
            'Authorization: Bearer ' . getenv('STREADPAY_API_KEY'),
            'Content-Type: application/json',
            'Idempotency-Key: ' . $orderId,
        ],
        CURLOPT_POSTFIELDS => json_encode(['amount' => $amount, 'merchant_ref' => $orderId]),
    ]);
    $json = json_decode(curl_exec($ch), true);
    curl_close($ch);
    if (!$json['success']) throw new Exception($json['error']['code']);
    return $json['data'];
}

// webhook.php
$raw = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_STREADPAY_TIMESTAMP'] ?? '';
$signature = str_replace('sha256=', '', $_SERVER['HTTP_X_STREADPAY_SIGNATURE'] ?? '');
$expected = hash_hmac('sha256', $timestamp . '.' . $raw, getenv('STREADPAY_WEBHOOK_SECRET'));

if (!hash_equals($expected, $signature) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(401);
    exit;
}
http_response_code(200);

$event = json_decode($raw, true);
if ($event['event'] === 'payment.paid') {
    // tandai pesanan $event['data']['merchant_ref'] lunas
}

# pip install requests flask
import hashlib, hmac, os, time
import requests
from flask import Flask, request, abort

API = "https://streadpay.com/v1"
KEY = os.environ["STREADPAY_API_KEY"]
SECRET = os.environ["STREADPAY_WEBHOOK_SECRET"]

def create_payment(order_id: str, amount: int) -> dict:
    r = requests.post(
        f"{API}/payments",
        headers={"Authorization": f"Bearer {KEY}", "Idempotency-Key": order_id},
        json={"amount": amount, "merchant_ref": order_id},
        timeout=15,
    )
    body = r.json()
    if not body["success"]:
        raise RuntimeError(body["error"]["code"])
    return body["data"]  # kirim body["data"]["qr_image_url"] ke pembeli

app = Flask(__name__)

@app.post("/webhook/streadpay")
def webhook():
    raw = request.get_data()
    ts = request.headers.get("X-StreadPay-Timestamp", "")
    sig = request.headers.get("X-StreadPay-Signature", "").replace("sha256=", "")
    expected = hmac.new(SECRET.encode(), f"{ts}.".encode() + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected) or abs(time.time() - int(ts or 0)) > 300:
        abort(401)
    event = request.get_json()
    if event["event"] == "payment.paid":
        pass  # tandai pesanan event["data"]["merchant_ref"] lunas
    return "", 200