HTTP API

Authentication

The API key is generated when an application is registered. In Swagger, click Authorize and provide the JWT and/or the API key.

Applications

curl -X POST http://localhost:3000/applications \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Store",
    "webhookUrl": "https://my-store.com/webhook/payment",
    "subscriptionWebhookUrl": "https://my-store.com/webhook/subscription"
  }'

Payments

Create a payment

{
  "amount": 50000,
  "provider": "MAYAR",
  "applicationOrderId": "ORDER-12345",
  "customerName": "Budi Santoso",
  "customerEmail": "budi@example.com",
  "customerPhone": "081234567890",
  "mayarPaymentMethod": "qris",
  "description": "Order #12345"
}

Response (abridged):

{
  "data": {
    "id": "uuid",
    "externalId": "trx-...",
    "status": "PENDING",
    "provider": "MAYAR",
    "checkoutUrl": "https://.../invoices/abc"
  },
  "checkoutUrl": "https://.../invoices/abc"
}

Payment link

Same body as /payments plus optional provider options objects: xenditOptions, midtransOptions and mayarOptions (expiredAt, paymentMethod).

Redirect URLs must be absolute http/https URLs. Local hosts such as http://localhost:3000/result are accepted so the flow can be tested in development. They are applied by Xendit and Midtrans only — Mayar invoices have no redirect parameter, so the values are ignored for provider: "MAYAR".

Subscriptions

Subscriptions are supported by Xendit and Midtrans. Provide the required metadata: Xendit needs pm_id and customerId; Midtrans needs saved_token_id.

Provider callbacks

See the Webhooks guide for payloads and forwarding details.

Admin API

The admin endpoints back the dashboard at /admin. They require an admin JWT (Authorization: Bearer <jwt>) issued by POST /login, and are not part of the public merchant API.

List endpoints return { "data": [...], "meta": { "page", "limit", "total", "totalPages" } }; single resources return { "data": { ... } }.

curl -X POST http://localhost:3000/login \
  -H "Content-Type: application/json" \
  -d '{ "username": "admin", "password": "admin123" }'

curl -X POST http://localhost:3000/admin/applications \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{ "name": "My Store", "webhookUrl": "https://my-store.com/webhook" }'

Status codes