ChaosPay Gateway API

https://api.labubu4d.lol

GET:
  X-Signature = hex(HMAC-SHA256(apiKey + timestamp + body, secretKey))

POST / PUT / PATCH / DELETE:
  X-Signature = hex(HMAC-SHA256(apiKey + timestamp + nonce + body, secretKey))

<?php
$baseUrl   = 'https://api.labubu4d.lol';
$apiKey    = 'API_KEY_ANDA';
$secretKey = 'SECRET_KEY_ANDA';

function gatewayRequest(string $method, string $path, ?array $payload = null): array
{
    global $baseUrl, $apiKey, $secretKey;

    $body      = $payload === null ? '' : json_encode($payload);
    $timestamp = (string) time();
    $headers   = ['X-API-Key: '.$apiKey, 'X-Timestamp: '.$timestamp, 'Content-Type: application/json'];

    if ($method === 'GET') {
        $toSign = $apiKey.$timestamp.$body;
    } else {
        $nonce    = bin2hex(random_bytes(16));
        $toSign   = $apiKey.$timestamp.$nonce.$body;
        $headers[] = 'X-Nonce: '.$nonce;
    }

    $headers[] = 'X-Signature: '.hash_hmac('sha256', $toSign, $secretKey);

    $ch = curl_init($baseUrl.$path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_HTTPHEADER     => $headers,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 30,
    ]);

    if ($method !== 'GET') {
        curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
    }

    return json_decode((string) curl_exec($ch), true) ?? [];
}

$payment = gatewayRequest('POST', '/api/v1/payment/qris', [
    'amount'      => 50000,
    'customer_id' => 'testnara',
    'order_id'    => 'INV-2024-001',
]);

// $payment['data']['qr_code'] untuk dirender sendiri,
// atau arahkan pelanggan ke $payment['data']['payment_url'].

const crypto = require('crypto');

const baseUrl = 'https://api.labubu4d.lol';
const apiKey = 'API_KEY_ANDA';
const secretKey = 'SECRET_KEY_ANDA';

async function gatewayRequest(method, path, payload = null) {
  const body = payload === null ? '' : JSON.stringify(payload);
  const timestamp = String(Math.floor(Date.now() / 1000));
  const headers = { 'X-API-Key': apiKey, 'X-Timestamp': timestamp, 'Content-Type': 'application/json' };

  let toSign = apiKey + timestamp + body;
  if (method !== 'GET') {
    const nonce = crypto.randomBytes(16).toString('hex');
    headers['X-Nonce'] = nonce;
    toSign = apiKey + timestamp + nonce + body;
  }
  headers['X-Signature'] = crypto.createHmac('sha256', secretKey).update(toSign).digest('hex');

  const res = await fetch(baseUrl + path, { method, headers, body: method === 'GET' ? undefined : body });
  return res.json();
}

gatewayRequest('POST', '/api/v1/payment/qris', {
  amount: 50000,
  customer_id: 'testnara',
  order_id: 'INV-2024-001',
}).then(console.log);

import hashlib, hmac, json, os, time
import requests

BASE_URL = 'https://api.labubu4d.lol'
API_KEY = 'API_KEY_ANDA'
SECRET_KEY = 'SECRET_KEY_ANDA'


def gateway_request(method, path, payload=None):
    body = '' if payload is None else json.dumps(payload, separators=(',', ':'))
    timestamp = str(int(time.time()))
    headers = {'X-API-Key': API_KEY, 'X-Timestamp': timestamp, 'Content-Type': 'application/json'}

    to_sign = API_KEY + timestamp + body
    if method != 'GET':
        nonce = os.urandom(16).hex()
        headers['X-Nonce'] = nonce
        to_sign = API_KEY + timestamp + nonce + body

    headers['X-Signature'] = hmac.new(SECRET_KEY.encode(), to_sign.encode(), hashlib.sha256).hexdigest()

    # Kirim persis string yang ditandatangani: data=body, bukan json=payload.
    return requests.request(method, BASE_URL + path, headers=headers, data=body or None, timeout=30).json()


print(gateway_request('POST', '/api/v1/payment/qris', {
    'amount': 50000,
    'customer_id': 'testnara',
    'order_id': 'INV-2024-001',
}))

{
  "success": true,
  "message": "OK",
  "data": { }
}

{
  "success": false,
  "error": "Invalid API credentials",
  "code": 401
}

{
  "transaction_id": "TRX2610241234567",
  "order_id": "INV-2024-001",
  "customer_id": "testnara",
  "transaction_status": "pending",
  "transaction_time": "2026-10-24 10:00:00",
  "payment_type": "qris",
  "gross_amount": 50000,
  "amount_paid": 50000,
  "fee_borne_by": "merchant",
  "fee_from_customer": 0,
  "fee_amount": 350,
  "net_amount": 49650,
  "currency": "IDR",
  "payment_url": "https://api.labubu4d.lol/pay/TRX2610241234567",
  "payment_url_direct": "https://api.labubu4d.lol/pay/TRX2610241234567",
  "qr_code": "00020101021226...",
  "expiry_time": "2026-10-24 10:10:00",
  "sandbox": false
}

{
  "status": "pending",
  "transaction_time": "2026-10-24 10:00:00",
  "expiry_time": "2026-10-24 10:10:00",
  "settlement_time": null
}

{
  "available": 15000000,
  "pending": 250000,
  "available_formatted": "Rp 15.000.000",
  "pending_formatted": "Rp 250.000"
}

{
  "transaction_id": "TRX2610241234567",
  "order_id": "INV-2024-001",
  "customer_id": "testnara",
  "transaction_status": "settlement",
  "transaction_time": "2026-10-24 10:00:00",
  "settlement_time": "2026-10-24 10:02:11",
  "payment_type": "qris",
  "gross_amount": 50000,
  "amount_paid": 50000,
  "fee_borne_by": "merchant",
  "fee_from_customer": 0,
  "fee_amount": 350,
  "net_amount": 49650,
  "currency": "IDR"
}

<?php
$secretKey = 'SECRET_KEY_ANDA';

$raw       = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_CALLBACK_SIGNATURE'] ?? '';

$payload = json_decode($raw, true);
if (! is_array($payload)) {
    http_response_code(400);
    exit;
}

ksort($payload);
$expected = hash_hmac(
    'sha256',
    json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES),
    $secretKey
);

if (! hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

if ($payload['transaction_status'] === 'settlement') {
    // tandai $payload['order_id'] lunas, cocokkan gross_amount dengan pesanan Anda
}

http_response_code(200);
echo 'OK';

const crypto = require('crypto');
const express = require('express');

const secretKey = 'SECRET_KEY_ANDA';
const app = express();

app.post('/callback', express.json(), (req, res) => {
  const payload = req.body;
  const sorted = Object.fromEntries(Object.keys(payload).sort().map((k) => [k, payload[k]]));
  const expected = crypto.createHmac('sha256', secretKey).update(JSON.stringify(sorted)).digest('hex');
  const given = String(req.get('X-Callback-Signature') || '');

  const ok = given.length === expected.length
    && crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected));
  if (!ok) return res.sendStatus(401);

  if (payload.transaction_status === 'settlement') {
    // tandai payload.order_id lunas
  }
  res.status(200).send('OK');
});

import hashlib, hmac, json
from flask import Flask, request

SECRET_KEY = 'SECRET_KEY_ANDA'
app = Flask(__name__)


@app.post('/callback')
def callback():
    payload = request.get_json(force=True)
    signed = json.dumps(dict(sorted(payload.items())), separators=(',', ':'), ensure_ascii=False)
    expected = hmac.new(SECRET_KEY.encode(), signed.encode(), hashlib.sha256).hexdigest()

    if not hmac.compare_digest(expected, request.headers.get('X-Callback-Signature', '')):
        return '', 401

    if payload['transaction_status'] == 'settlement':
        pass  # tandai payload['order_id'] lunas

    return 'OK', 200