Tutorial Pasang

curl -X POST https://pay.arenago.app/api/v1/payments/create \
  -H "X-API-Key: $QRISKU_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 10000,
    "description": "Top up saldo",
    "order_id": "INV-1001",
    "fee_by": "buyer",
    "return_url": "https://tokokamu.com/terima-kasih"
  }'

<?php
// create-payment.php — jalankan: QRISKU_API_KEY=qk_live_xxx php create-payment.php
$baseUrl = getenv('QRISKU_BASE_URL') ?: 'https://pay.arenago.app';
$apiKey  = getenv('QRISKU_API_KEY'); // simpan di .env server, jangan di frontend

function qrisku_request(string $path, array $body): array {
    global $baseUrl, $apiKey;
    $ch = curl_init($baseUrl . $path);
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 30,
        CURLOPT_HTTPHEADER     => ['Content-Type: application/json', 'X-API-Key: ' . $apiKey],
        CURLOPT_POSTFIELDS     => json_encode($body),
    ]);
    $raw = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    if ($raw === false) throw new Exception('Koneksi gagal: ' . curl_error($ch));
    $json = json_decode($raw, true);
    if (empty($json['success'])) throw new Exception("Error $status: " . ($json['error'] ?? $raw));
    return $json['data'];
}

if (basename(__FILE__) === basename($_SERVER['SCRIPT_FILENAME'] ?? '')) {
    $p = qrisku_request('/api/v1/payments/create', [
        'amount'      => 10000,
        'description' => 'Top up saldo',
        'order_id'    => 'INV-' . time(),
        'fee_by'      => 'buyer',
    ]);
    echo "ID transaksi : {$p['transaction_id']}\n";
    echo "Total bayar  : {$p['total_amount']}\n";
    echo "Link checkout: {$p['payment_url']}\n";
}

// create-payment.mjs — jalankan: QRISKU_API_KEY=qk_live_xxx node create-payment.mjs
const BASE_URL = process.env.QRISKU_BASE_URL || 'https://pay.arenago.app';
const API_KEY = process.env.QRISKU_API_KEY; // simpan di .env server, jangan di frontend

export async function createPayment({ amount, description, orderId, returnUrl }) {
  const res = await fetch(`${BASE_URL}/api/v1/payments/create`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', 'X-API-Key': API_KEY },
    body: JSON.stringify({ amount, description, order_id: orderId, fee_by: 'buyer', return_url: returnUrl }),
  });
  const json = await res.json();
  if (!json.success) throw new Error(`Gagal buat pembayaran (${res.status}): ${json.error}`);
  return json.data; // transaction_id, payment_url, qr_image_url, total_amount, expires_at, ...
}

if (import.meta.url === `file://${process.argv[1]}`) {
  const p = await createPayment({ amount: 10000, description: 'Top up saldo', orderId: 'INV-' + Date.now() });
  console.log('ID transaksi :', p.transaction_id);
  console.log('Total bayar  :', p.total_amount);
  console.log('Link checkout:', p.payment_url);
}

curl -X POST https://pay.arenago.app/api/v1/payments/status \
  -H "X-API-Key: $QRISKU_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"transaction_id": "TX..."}'
# atau cari pakai order_id kamu sendiri: -d '{"order_id": "INV-1001"}'

<?php
// check-status.php — jalankan: QRISKU_API_KEY=qk_live_xxx php check-status.php TX...
require __DIR__ . '/create-payment.php'; // pakai fungsi qrisku_request() dari contoh sebelumnya

$data = qrisku_request('/api/v1/payments/status', ['transaction_id' => $argv[1] ?? '']);
echo $data['transaction_id'] . ' => ' . $data['status'] . "\n"; // pending | paid | expired | failed
if ($data['status'] === 'paid') {
    // tandai order kamu lunas di database
}

// check-status.mjs — jalankan: QRISKU_API_KEY=qk_live_xxx node check-status.mjs TX...
const BASE_URL = process.env.QRISKU_BASE_URL || 'https://pay.arenago.app';
const API_KEY = process.env.QRISKU_API_KEY;

export async function getStatus(transactionId) {
  const res = await fetch(`${BASE_URL}/api/v1/payments/status`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', 'X-API-Key': API_KEY },
    body: JSON.stringify({ transaction_id: transactionId }),
  });
  const json = await res.json();
  if (!json.success) throw new Error(`Gagal cek status (${res.status}): ${json.error}`);
  return json.data; // data.status: pending | paid | expired | failed
}

if (import.meta.url === `file://${process.argv[1]}`) {
  const d = await getStatus(process.argv[2]);
  console.log(d.transaction_id, '=>', d.status, d.paid_at ? `(dibayar ${d.paid_at})` : '');
}

<?php
// webhook.php — taruh di https://tokokamu.com/qris-webhook.php lalu isi URL itu di Portal Brand.
$secret = getenv('QRISKU_WEBHOOK_SECRET'); // whsec_...

$raw       = file_get_contents('php://input'); // body mentah, JANGAN pakai $_POST
$timestamp = $_SERVER['HTTP_X_QRISKU_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_QRISKU_SIGNATURE'] ?? '';

$expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $raw, $secret);
if (!$timestamp || abs(time() - (int) $timestamp) > 300 || !hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('invalid signature');
}

$payload = json_decode($raw, true);
$event   = $payload['event'];
$data    = $payload['data'];

if ($event === 'payment.success') {
    // Update order sekali saja (idempotent), contoh:
    // UPDATE orders SET status='paid' WHERE order_id = ? AND status <> 'paid'
    error_log("LUNAS: {$data['order_id']} Rp{$data['total_amount']}");
} elseif ($event === 'payment.expired' || $event === 'payment.failed') {
    error_log("BATAL: {$data['order_id']} ({$data['status']})");
}

http_response_code(200);
echo 'ok';

// webhook-server.mjs — penerima webhook tanpa framework (Node 18+).
// Jalankan: QRISKU_WEBHOOK_SECRET=whsec_xxx PORT=8080 node webhook-server.mjs
import http from 'node:http';
import crypto from 'node:crypto';

const SECRET = process.env.QRISKU_WEBHOOK_SECRET;
const MAX_AGE = 5 * 60; // tolak webhook yang lebih tua dari 5 menit (anti replay)

export function verifySignature(rawBody, timestamp, signature, secret = SECRET) {
  if (!timestamp || !signature) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > MAX_AGE) return false;
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(`${timestamp}.${rawBody}`).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(String(signature));
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const server = http.createServer((req, res) => {
  if (req.method !== 'POST' || req.url !== '/qris-webhook') { res.writeHead(404).end(); return; }
  let raw = '';
  req.on('data', (c) => (raw += c));
  req.on('end', () => {
    // PENTING: verifikasi pakai body mentah (raw), bukan hasil JSON.parse lalu stringify.
    const ok = verifySignature(raw, req.headers['x-qrisku-timestamp'], req.headers['x-qrisku-signature']);
    if (!ok) { res.writeHead(401).end('invalid signature'); return; }
    const { event, data } = JSON.parse(raw);
    if (event === 'payment.success') {
      // Update order sekali saja (idempotent): cek dulu apakah data.order_id sudah lunas.
      console.log(`LUNAS: ${data.order_id || data.transaction_id} Rp${data.total_amount}`);
    } else if (event === 'payment.expired' || event === 'payment.failed') {
      console.log(`BATAL: ${data.order_id || data.transaction_id} (${data.status})`);
    } else if (event === 'webhook.test') {
      console.log('Webhook tes diterima, signature valid');
    }
    res.writeHead(200, { 'Content-Type': 'text/plain' }).end('ok'); // balas 2xx secepatnya
  });
});
server.listen(process.env.PORT || 8080, () => console.log('Webhook siap di :' + (process.env.PORT || 8080) + '/qris-webhook'));

<?php
// checkout.php — tombol "Bayar pakai QRIS" sederhana.
require __DIR__ . '/create-payment.php'; // fungsi qrisku_request()

$product = ['name' => 'Paket Premium 1 Bulan', 'price' => 49000];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $orderId = 'ORD-' . time(); // simpan order ini di database kamu dengan status "menunggu"
    try {
        $p = qrisku_request('/api/v1/payments/create', [
            'amount'      => $product['price'],
            'description' => $product['name'],
            'order_id'    => $orderId,
            'return_url'  => 'https://tokokamu.com/terima-kasih.php?order=' . $orderId,
        ]);
        header('Location: ' . $p['payment_url'], true, 303); // ke halaman QRIS
        exit;
    } catch (Exception $e) {
        http_response_code(502);
        exit('Gagal membuat pembayaran: ' . htmlspecialchars($e->getMessage()));
    }
}
?>
<!doctype html><meta charset="utf-8"><title>Toko Contoh</title>
<h1><?= htmlspecialchars($product['name']) ?></h1>
<p>Harga: Rp <?= number_format($product['price'], 0, ',', '.') ?></p>
<form method="post"><button>Bayar pakai QRIS</button></form>

// checkout-server.mjs — contoh toko mini: tombol "Bayar pakai QRIS" -> halaman checkout.
// Jalankan: QRISKU_API_KEY=qk_live_xxx PORT=8081 node checkout-server.mjs
import http from 'node:http';

const BASE_URL = process.env.QRISKU_BASE_URL || 'https://pay.arenago.app';
const API_KEY = process.env.QRISKU_API_KEY;
const SHOP_URL = process.env.SHOP_URL || `http://localhost:${process.env.PORT || 8081}`;
const PRODUCT = { name: 'Paket Premium 1 Bulan', price: 49000 };

const html = `<!doctype html><meta charset="utf-8"><title>Toko Contoh</title>
<h1>${PRODUCT.name}</h1><p>Harga: Rp ${PRODUCT.price.toLocaleString('id-ID')}</p>
<form method="post" action="/checkout"><button>Bayar pakai QRIS</button></form>`;

http.createServer(async (req, res) => {
  if (req.method === 'GET' && req.url === '/') return res.writeHead(200, { 'Content-Type': 'text/html' }).end(html);
  if (req.method === 'POST' && req.url === '/checkout') {
    const orderId = 'ORD-' + Date.now(); // simpan order ini di database kamu dengan status "menunggu"
    const r = await fetch(`${BASE_URL}/api/v1/payments/create`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json', 'X-API-Key': API_KEY },
      body: JSON.stringify({ amount: PRODUCT.price, description: PRODUCT.name, order_id: orderId, return_url: `${SHOP_URL}/terima-kasih?order=${orderId}` }),
    });
    const j = await r.json();
    if (!j.success) return res.writeHead(502, { 'Content-Type': 'text/plain' }).end('Gagal membuat pembayaran: ' + j.error);
    return res.writeHead(303, { Location: j.data.payment_url }).end(); // arahkan pembeli ke halaman QRIS
  }
  if (req.url.startsWith('/terima-kasih')) return res.writeHead(200, { 'Content-Type': 'text/html' }).end('<h1>Terima kasih!</h1><p>Status final tetap ikut webhook.</p>');
  res.writeHead(404).end();
}).listen(process.env.PORT || 8081, () => console.log('Toko contoh di ' + SHOP_URL));