Dokumentasi API Aulaa

Authorization: Bearer pgw_id_xxxxxxxxxxxxxxxx

https://payment.aulaa.co/checkout/{ProjectID}/{Amount}?order_id={OrderID}&sig={Signature}

const crypto = require('crypto');

const projectID = 'b2c3d4e5-f6a7-8901-bcde-f12345678901';
const amount = 50000;
const orderID = 'INV-20260627-001';
const secret = 'YOUR_WEBHOOK_SECRET'; // Diambil dari Dashboard -> Projects

// Format string: checkout:v1:{ProjectID}:{Amount}:{OrderID}
const payload = `checkout:v1:${projectID}:${amount}:${orderID}`;
const signature = crypto
  .createHmac('sha256', secret)
  .update(payload)
  .digest('hex');

const checkoutURL = `https://payment.aulaa.co/checkout/${projectID}/${amount}?order_id=${orderID}&sig=${signature}`;
console.log(checkoutURL);

https://payment.aulaa.co/pay/{ID}

// 1. Buat pembayaran dari backend Anda
const res = await fetch('https://api.aulaa.co/v1/payments', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer pgw_id_xxxxxxxxxxxxxxxx',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    order_id: 'INV-20260627-001',
    amount: 50000,
    payment_method: 'qris',
  }),
});
const payment = await res.json();

// 2. Arahkan pelanggan ke halaman pembayaran Aulaa
const url = `https://payment.aulaa.co/pay/${payment.id}`;
window.location.href = url; // atau kirim 'url' ini ke pelanggan

curl https://api.aulaa.co/v1/payments/methods \
  -H "Authorization: Bearer pgw_id_xxxxxxxxxxxxxxxx"

{
  "country": "ID",
  "currency": "IDR",
  "methods": [
    { "Code": "qris",   "Name": "QRIS",                  "Type": "qr_code",          "IsAvailable": true },
    { "Code": "bca_va", "Name": "BCA Virtual Account",   "Type": "virtual_account",  "IsAvailable": true },
    { "Code": "bri_va", "Name": "BRI Virtual Account",   "Type": "virtual_account",  "IsAvailable": true },
    { "Code": "gopay",  "Name": "GoPay",                 "Type": "ewallet",          "IsAvailable": true },
    { "Code": "ovo",    "Name": "OVO",                   "Type": "ewallet",          "IsAvailable": true }
    // ...
  ]
}

{
  "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "order_id": "INV-20260627-001",
  "status": "pending",
  "amount": 50000,
  "fee_amount": 350,
  "total_amount": 50350,
  "charged_amount": 50000,
  "processing_fee": 0,
  "currency": "IDR",
  "country_code": "ID",
  "payment_method": "qris",
  "payment_number": "00020101021226670016COM.NOBUBANK...",
  "expired_at": "2026-06-27T08:00:00Z",
  "paid_at": null,
  "created_at": "2026-06-27T07:00:00Z"
}

// Library QR — pilih sesuai stack Anda:
//   React  : npm i qrcode.react        Node : npm i qrcode
//   Python : pip install qrcode        PHP  : composer require endroid/qr-code
//   Go     : go get github.com/skip2/go-qrcode

// --- Contoh React (qrcode.react) ---
import { QRCodeCanvas } from 'qrcode.react'

// payment.payment_number = string QRIS dari response POST /v1/payments
<QRCodeCanvas value={payment.payment_number} size={256} />

// --- Contoh Node.js (qrcode) → data URL untuk <img src=...> ---
import QRCode from 'qrcode'
const qrImg = await QRCode.toDataURL(payment.payment_number)
// <img src={qrImg} alt="QRIS" />

// Untuk Virtual Account, payment_number cukup ditampilkan apa adanya
// sebagai teks + tombol "Salin" (tidak perlu library QR).

curl https://api.aulaa.co/v1/payments/f47ac10b-58cc-4372-a567-0e02b2c3d479 \
  -H "Authorization: Bearer pgw_id_xxxxxxxxxxxxxxxx"

{
  "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "order_id": "INV-20260627-001",
  "status": "paid",
  "amount": 50000,
  "fee_amount": 350,
  "total_amount": 50350,
  "charged_amount": 50000,
  "processing_fee": 0,
  "currency": "IDR",
  "country_code": "ID",
  "payment_method": "qris",
  "payment_number": "00020101021226670016COM.NOBUBANK...",
  "expired_at": "2026-06-27T08:00:00Z",
  "paid_at": "2026-06-27T07:15:32Z",
  "created_at": "2026-06-27T07:00:00Z"
}

curl -X POST \
  https://api.aulaa.co/v1/payments/f47ac10b-58cc-4372-a567-0e02b2c3d479/cancel \
  -H "Authorization: Bearer pgw_id_xxxxxxxxxxxxxxxx"

{
  "order_id": "INV-20260627-001",
  "amount": 50000,
  "currency": "IDR",
  "country_code": "ID",
  "status": "paid",
  "payment_method": "qris",
  "formatted_amount": "Rp 50.000",
  "paid_at": "2026-06-27T07:15:32Z"
}

const crypto = require('crypto');
const express = require('express');
const app = express();

// PENTING: signature dihitung dari RAW body (byte mentah), jadi
// gunakan express.raw — bukan express.json — di endpoint webhook.
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'];

  const expected = crypto
    .createHmac('sha256', process.env.AULAA_WEBHOOK_SECRET)
    .update(req.body)            // req.body = Buffer (raw)
    .digest('hex');             // hex, TANPA prefix "sha256="

  const valid = signature && crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );

  if (!valid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(req.body.toString());
  if (event.status === 'paid') {
    // Verifikasi order_id & amount sesuai data Anda, lalu update order
    console.log('Pembayaran lunas:', event.order_id);
  }

  res.status(200).json({ received: true });
});

{
  "error": "amount must be between 1000 and 500000000 IDR"
}