Webhook Handling

Overview

Beberapa transaksi SNAP bersifat asinkron — hasilnya dikirim via webhook (HTTP POST) ke URL yang kamu konfigurasi.

Webhook Events

Service Code	Event	Keterangan
24-35	VA Payment	Pembayaran virtual account
52	QR MPM Notify	Notifikasi pembayaran QRIS
41	Bulk Cashin Notify	Bulk top-up e-money
21	Interbank Bulk Notify	Bulk transfer interbank
56	Direct Debit Notify	Notifikasi direct debit

Konfigurasi

Di dashboard, buka Webhooks dan tambahkan URL callback:

• Provider: Pilih provider (BCA, BRI, dll)
• Service Code: Pilih jenis notifikasi
• Notify URL: URL endpoint kamu (harus HTTPS di production)

Verifikasi Signature

Setiap webhook menyertakan header X-SIGNATURE yang ditandatangani dengan RSA server key.

import crypto from 'crypto';

app.post('/webhook/snap', (req, res) => {
  const signature = req.headers['x-signature'];
  const timestamp = req.headers['x-timestamp'];

  // String to sign = method + ":" + path + ":" + body + ":" + timestamp
  const body = JSON.stringify(req.body);
  const stringToSign = `POST:${req.path}:${body}:${timestamp}`;

  // Verify with server's public key
  const isValid = crypto.verify(
    'sha256',
    Buffer.from(stringToSign),
    serverPublicKey,
    Buffer.from(signature, 'base64')
  );

  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Process webhook
  console.log('Webhook received:', req.body);
  res.json({ responseCode: '00', responseMessage: 'Success' });
});

Testing

Gunakan Testing Console di admin panel untuk mengirim webhook manual dengan berbagai outcome (success, pending, failed, expired).