API Documentation

1. Authentication

StabioPay uses a multi-tenant API Key architecture. Every API request must be authenticated using the Public Key and Secret Key of the specific store/QRIS profile you are targeting.

Provide the keys in the HTTP headers:

X-Api-Key: pub_YOUR_PUBLIC_KEY
X-Api-Secret: sec_YOUR_SECRET_KEY

2. Create a Payment Session

To initiate a transaction matching process, create a payment session before showing the QRIS code to the user.

Request Body (JSON)

Example Request

curl -X POST https://qrista.my.id/api/v1/payments \
-H "X-Api-Key: pub_abc123" \
-H "X-Api-Secret: sec_xyz789" \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
-d '{
    "invoice_id": "INV-2023-001",
    "amount": 50000,
    "description": "Payment for Shoes"
}'

Example Response

{
    "payment": {
        "id": 1,
        "payment_id": "PAY-8F92KD",
        "invoice_id": "INV-2023-001",
        "amount": 50000,
        "status": "pending",
        "expires_at": "2023-10-27T10:15:00.000000Z"
    },
    "qris_payload": "00020101021226...5405500006304ABCD"
}

Render the qris_payload string as a QR Code image on your frontend for the customer to scan.

3. Receiving Webhooks

When a payment is successfully matched, we will send an HTTP POST request to the Webhook URL configured in your Store settings.

Security (HMAC Validation)

To verify the webhook originated from StabioPay, we sign the payload using your Store's Webhook Secret. Validate the X-StabioPay-Signature header in your application:

// PHP / Laravel Example
$payload = $request->getContent();
$signature = $request->header('X-StabioPay-Signature');
$expected = hash_hmac('sha256', $payload, 'YOUR_WEBHOOK_SECRET');

if (!hash_equals($expected, $signature)) {
    abort(401, 'Invalid signature');
}

Webhook Payload

{
    "event": "payment.success",
    "data": {
        "payment_id": "PAY-XYZ123",
        "invoice_id": "INV-2023-001",
        "amount": 50000,
        "status": "success",
        "matched_at": "2023-10-27T10:00:00Z"
    }
}