Dokumentasi API ChaosPay

# client_signature = md5(username + amount + secret_key)
curl -X POST https://api.labubu4d.lol/payment \
  -H "Content-Type: application/json" \
  -H "X-API-KEY: YOUR_API_KEY" \
  -d '{
    "merchant": "YOUR_MERCHANT_ID",
    "username": "customer001",
    "amount": 50000,
    "order_id": "INV-10023",
    "client_signature": "3f2a9c0e7b1d4a8e9f6c5b2a1d0e9f8c"
  }'

<?php
$apiKey    = 'YOUR_API_KEY';
$secretKey = 'YOUR_SECRET_KEY';

$body = [
    'merchant' => 'YOUR_MERCHANT_ID',
    'username' => 'customer001',
    'amount'   => 50000,
    'order_id' => 'INV-10023',
];
$body['client_signature'] = md5($body['username'] . $body['amount'] . $secretKey);

$ch = curl_init('https://api.labubu4d.lol/payment');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode($body),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json', 'X-API-KEY: ' . $apiKey],
]);
$response = json_decode(curl_exec($ch), true);

if ($response['code'] === 200) {
    // Show $response['data']['qr'] as a QR code, or redirect to $response['data']['payment_url']
}

// Node.js 18+
const crypto = require('crypto');

(async () => {
  const apiKey = 'YOUR_API_KEY';
  const secretKey = 'YOUR_SECRET_KEY';

  const body = { merchant: 'YOUR_MERCHANT_ID', username: 'customer001', amount: 50000, order_id: 'INV-10023' };
  body.client_signature = crypto.createHash('md5').update(body.username + body.amount + secretKey).digest('hex');

  const res = await fetch('https://api.labubu4d.lol/payment', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', 'X-API-KEY': apiKey },
    body: JSON.stringify(body),
  });
  const { code, message, data } = await res.json();
  // code === 200 → show data.qr as a QR code, or redirect to data.payment_url
})();

import hashlib, requests

api_key, secret_key = "YOUR_API_KEY", "YOUR_SECRET_KEY"

body = {"merchant": "YOUR_MERCHANT_ID", "username": "customer001", "amount": 50000, "order_id": "INV-10023"}
body["client_signature"] = hashlib.md5(f'{body["username"]}{body["amount"]}{secret_key}'.encode()).hexdigest()

r = requests.post("https://api.labubu4d.lol/payment", json=body, headers={"X-API-KEY": api_key}, timeout=30)
resp = r.json()
# resp["code"] == 200 → show resp["data"]["qr"] as a QR code, or redirect to resp["data"]["payment_url"]

{
  "code": 200,
  "message": "OK",
  "data": {
    "transaction_id": "TRX2610211430151234",
    "order_id": "INV-10023",
    "amount": 50000,
    "create_date": "2026-10-21 14:30:15",
    "expire_date": "2026-10-21 14:40:15",
    "status": 0,
    "qr": "00020101021226...6304ABCD",
    "payment_url": null,
    "sandbox": false
  }
}

curl -G https://api.labubu4d.lol/payment/status \
  -H "X-API-KEY: YOUR_API_KEY" \
  --data-urlencode "merchant=YOUR_MERCHANT_ID" \
  --data-urlencode "order_id=INV-10023"

<?php
$query = http_build_query(['merchant' => 'YOUR_MERCHANT_ID', 'order_id' => 'INV-10023']);

$ch = curl_init('https://api.labubu4d.lol/payment/status?' . $query);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['X-API-KEY: YOUR_API_KEY'],
]);
$response = json_decode(curl_exec($ch), true);

if ($response['code'] === 200 && $response['data']['status'] === 1) {
    // paid
}

// Node.js 18+
(async () => {
  const query = new URLSearchParams({ merchant: 'YOUR_MERCHANT_ID', order_id: 'INV-10023' });
  const res = await fetch(`https://api.labubu4d.lol/payment/status?${query}`, { headers: { 'X-API-KEY': 'YOUR_API_KEY' } });
  const { code, data } = await res.json();
  // code === 200 && data.status === 1 → paid
})();

import requests

r = requests.get("https://api.labubu4d.lol/payment/status",
                 params={"merchant": "YOUR_MERCHANT_ID", "order_id": "INV-10023"},
                 headers={"X-API-KEY": "YOUR_API_KEY"}, timeout=30)
resp = r.json()
# resp["code"] == 200 and resp["data"]["status"] == 1 → paid

{
  "code": 200,
  "message": "OK",
  "data": {
    "merchant": "YOUR_MERCHANT_ID",
    "transaction_id": "TRX2610211430151234",
    "order_id": "INV-10023",
    "idrpayment_id": "88231907",
    "username": "customer001",
    "amount": 50000,
    "status": 1,
    "local_status": "completed",
    "remark": "",
    "sandbox": false
  }
}

curl -G https://api.labubu4d.lol/account/balance \
  -H "X-API-KEY: YOUR_API_KEY" \
  --data-urlencode "merchant=YOUR_MERCHANT_ID"

{
  "code": 200,
  "message": "OK",
  "data": {
    "merchant": "YOUR_MERCHANT_ID",
    "currency": "IDR",
    "available": "12500000.00",
    "pending_settlement": "1500000.00",
    "settled_total": "84000000.00"
  }
}

{
  "code": 200,
  "message": "OK",
  "data": [
    {
      "bank_id": 12,
      "bank_name": "BCA",
      "account_name": "PT CONTOH MERCHANT",
      "account_number": "123****890",
      "is_default": true
    }
  ]
}

# POST requests signed with v2: the payload is the raw JSON body, byte for byte.
API_KEY='YOUR_API_KEY'; SECRET='YOUR_SECRET_KEY'
BODY='{"merchant":"YOUR_MERCHANT_ID","payout_id":"PO-2026-0001","bank_id":12,"amount":1500000,"note":"October settlement"}'

TS=$(date +%s); NONCE=$(openssl rand -hex 8)
BODY_HASH=$(printf '%s' "$BODY" | openssl dgst -sha256 -hex | sed 's/^.* //')
SIGNATURE=$(printf 'POST\n/payout\n%s\n%s\n%s' "$TS" "$NONCE" "$BODY_HASH" \
  | openssl dgst -sha256 -hmac "$SECRET" -hex | sed 's/^.* //')

curl -X POST https://api.labubu4d.lol/payout \
  -H "Content-Type: application/json" \
  -H "X-API-KEY: $API_KEY" -H "X-Timestamp: $TS" -H "X-Nonce: $NONCE" -H "X-Signature: $SIGNATURE" \
  --data-raw "$BODY"

<?php
// Uses chaospaySign() from the Authentication section.
$payload = json_encode([
    'merchant'  => 'YOUR_MERCHANT_ID',
    'payout_id' => 'PO-2026-0001',
    'bank_id'   => 12,
    'amount'    => 1500000,
    'note'      => 'October settlement',
]);

$headers = chaospaySign('POST', '/payout', $payload, 'YOUR_SECRET_KEY');

$ch = curl_init('https://api.labubu4d.lol/payout');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $payload,      // send exactly the bytes you signed
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'X-API-KEY: YOUR_API_KEY',
        'X-Timestamp: ' . $headers['X-Timestamp'],
        'X-Nonce: ' . $headers['X-Nonce'],
        'X-Signature: ' . $headers['X-Signature'],
    ],
]);
$response = json_decode(curl_exec($ch), true);

// Uses chaospaySign() from the Authentication section.

(async () => {
  const payload = JSON.stringify({
    merchant: 'YOUR_MERCHANT_ID', payout_id: 'PO-2026-0001', bank_id: 12, amount: 1500000, note: 'October settlement',
  });

  const res = await fetch('https://api.labubu4d.lol/payout', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', 'X-API-KEY': 'YOUR_API_KEY', ...chaospaySign('POST', '/payout', payload, 'YOUR_SECRET_KEY') },
    body: payload, // send exactly the string you signed
  });
  const result = await res.json();
})();

# Uses chaospay_sign() from the Authentication section.
import json, requests

payload = json.dumps({"merchant": "YOUR_MERCHANT_ID", "payout_id": "PO-2026-0001", "bank_id": 12,
                      "amount": 1500000, "note": "October settlement"})

headers = {"Content-Type": "application/json", "X-API-KEY": "YOUR_API_KEY",
           **chaospay_sign("POST", "/payout", payload, "YOUR_SECRET_KEY")}
r = requests.post("https://api.labubu4d.lol/payout", data=payload, headers=headers, timeout=30)  # send the exact string you signed
result = r.json()

# GET requests signed with v2: the payload is the raw query string, exactly as sent.
API_KEY='YOUR_API_KEY'; SECRET='YOUR_SECRET_KEY'
URI_PATH='/payout/status'
QUERY='merchant=YOUR_MERCHANT_ID&payout_id=PO-2026-0001'

TS=$(date +%s); NONCE=$(openssl rand -hex 8)
BODY_HASH=$(printf '%s' "$QUERY" | openssl dgst -sha256 -hex | sed 's/^.* //')
SIGNATURE=$(printf 'GET\n%s\n%s\n%s\n%s' "$URI_PATH" "$TS" "$NONCE" "$BODY_HASH" \
  | openssl dgst -sha256 -hmac "$SECRET" -hex | sed 's/^.* //')

curl "https://api.labubu4d.lol$URI_PATH?$QUERY" \
  -H "X-API-KEY: $API_KEY" -H "X-Timestamp: $TS" -H "X-Nonce: $NONCE" -H "X-Signature: $SIGNATURE"

<?php
// Uses chaospaySign() from the Authentication section.
$query = http_build_query(['merchant' => 'YOUR_MERCHANT_ID', 'payout_id' => 'PO-2026-0001']);
$headers = chaospaySign('GET', '/payout/status', $query, 'YOUR_SECRET_KEY');

$ch = curl_init('https://api.labubu4d.lol/payout/status?' . $query); // the same query string that was signed
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'X-API-KEY: YOUR_API_KEY',
        'X-Timestamp: ' . $headers['X-Timestamp'],
        'X-Nonce: ' . $headers['X-Nonce'],
        'X-Signature: ' . $headers['X-Signature'],
    ],
]);
$response = json_decode(curl_exec($ch), true);

// Uses chaospaySign() from the Authentication section.
(async () => {
  const query = new URLSearchParams({ merchant: 'YOUR_MERCHANT_ID', payout_id: 'PO-2026-0001' }).toString();

  const res = await fetch(`https://api.labubu4d.lol/payout/status?${query}`, { // the same query string that was signed
    headers: { 'X-API-KEY': 'YOUR_API_KEY', ...chaospaySign('GET', '/payout/status', query, 'YOUR_SECRET_KEY') },
  });
  const result = await res.json();
})();

# Uses chaospay_sign() from the Authentication section.
import requests
from urllib.parse import urlencode

query = urlencode({"merchant": "YOUR_MERCHANT_ID", "payout_id": "PO-2026-0001"})
headers = {"X-API-KEY": "YOUR_API_KEY", **chaospay_sign("GET", "/payout/status", query, "YOUR_SECRET_KEY")}

# Put the signed string in the URL yourself; passing params= lets requests re-encode it.
r = requests.get(f"https://api.labubu4d.lol/payout/status?{query}", headers=headers, timeout=30)
result = r.json()