Authentication

SNAP menggunakan beberapa lapisan autentikasi:

1. B2B Access Token

Token JWT yang digunakan untuk mengautentikasi setiap request transaksi.

Flow

Client                                    Server
  |                                         |
  |  1. Sign(clientId + "|" + timestamp)   |
  |  ──── POST /access-token/b2b ────────> |
  |                                         |  2. Verify RSA signature
  |                                         |  3. Generate JWT
  |  <── { accessToken, expiresIn } ────── |
  |                                         |

Request Headers

Header	Value	Keterangan
Authorization	Basic base64(clientId:clientSecret)	Kredensial client
X-TIMESTAMP	2026-07-01T10:30:00+07:00	Timestamp ISO 8601
X-SIGNATURE	base64(RSA_SHA256(stringToSign))	Signature RSA
CHANNEL-ID	95161	Channel code (required untuk beberapa provider)

String to Sign

{clientId}|{timestamp}

Contoh: abc123|2026-07-01T10:30:00+07:00

Signature Generation

const stringToSign = `${clientId}|${timestamp}`;
const signature = crypto
  .sign('sha256', Buffer.from(stringToSign), privateKey)
  .toString('base64');

2. Transaction Signature (HMAC-SHA512)

Setiap request transaksi harus menyertakan signature HMAC.

String to Sign

{METHOD}:{PATH}:{ACCESS_TOKEN}:{SHA256(BODY)}:{TIMESTAMP}

Contoh:

POST:/bca/v1.0/balance-inquiry:eyJhbGciOi...:a1b2c3d4...:2026-07-01T10:30:00+07:00

Signature Generation

const bodyHash = crypto.createHash('sha256').update(body).digest('hex');
const stringToSign = `${method}:${path}:${token}:${bodyHash}:${timestamp}`;
const signature = crypto
  .createHmac('sha512', clientSecret)
  .update(stringToSign)
  .digest('base64');

3. Asymmetric Signature (RSA-SHA256)

Beberapa provider (BNC, DANA) menggunakan RSA alih-alih HMAC untuk transaction signature.

String to sign format sama, tapi signature menggunakan RSA private key alih-alih HMAC client secret.

Provider-Specific Variations

Provider	Token Path	Signature Encoding	Notes
BCA	/v1.0/access-token/b2b	Base64	CHANNEL-ID required
BRI	/v1.0/access-token/b2b	Base64
Mandiri	/openapi/v1.0/access-token/b2b	Base64
BNI	/snap/v1.0/access-token/b2b	Base64
BNC	/open/bi/v1.0/get/token	Base64	RSA asymmetric token
OVO	/OVOSNAP/v3.0/access-token/b2b	HEX	Hex encoding, bukan base64
DANA	/v1.0/access-token/b2b	Base64	Some services use asymmetric-without-token