Trusted Pay Merchant API

{
  "code": 200,
  "message": "Success",
  "data": { /* endpoint-specific object, null on errors */ }
}

import hashlib

def sign(*parts) -> str:
    """SHA-512 of the parts joined with '|' (client secret last), lowercase hex."""
    return hashlib.sha512("|".join(str(p) for p in parts).encode("utf-8")).hexdigest()

signature = sign(client_id, order_id, total_amount, client_secret)

function sign(...$parts): string {
    // SHA-512 of the parts joined with '|' (client secret last), lowercase hex.
    return hash('sha512', implode('|', $parts));
}

$signature = sign($clientId, $orderId, $totalAmount, $clientSecret);

import { createHash } from "node:crypto";

// SHA-512 of the parts joined with '|' (client secret last), lowercase hex.
const sign = (...parts) => createHash("sha512").update(parts.join("|"), "utf8").digest("hex");

const signature = sign(clientId, orderId, totalAmount, clientSecret);

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.HexFormat;

static String sign(String... parts) throws Exception {
    byte[] digest = MessageDigest.getInstance("SHA-512")
        .digest(String.join("|", parts).getBytes(StandardCharsets.UTF_8));
    return HexFormat.of().formatHex(digest); // lowercase hex
}

String signature = sign(clientId, orderId, String.valueOf(totalAmount), clientSecret);

import (
    "crypto/sha512"
    "encoding/hex"
    "strconv"
    "strings"
)

func sign(parts ...string) string {
    sum := sha512.Sum512([]byte(strings.Join(parts, "|")))
    return hex.EncodeToString(sum[:]) // lowercase hex
}

signature := sign(clientID, orderID, strconv.Itoa(totalAmount), clientSecret)

curl -X POST https://api.trustedpay.vip/api/order/create \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "8F3C2A9E1B7D4C6A0E5F9B2D7C1A3E8F",
    "orderId": "INV-1001",
    "totalAmount": 200000,
    "paymentType": "QRIS",
    "customerName": "Andi",
    "customerEmail": "[email protected]",
    "customerPhone": "6281234567890",
    "notifyUrl": "https://merchant.example/callback/trustedpay",
    "signature": "0d80561a60fb1bdb3997158f84fb8d808ea2dc1cbe7357aeacb647840ea37abc0097547132d28a01d48a7d46658a4772e281a6608590ac264003b4d448e5b250"
  }'

import hashlib, requests

BASE_URL = "https://api.trustedpay.vip"
CLIENT_ID, CLIENT_SECRET = "8F3C2A9E1B7D4C6A0E5F9B2D7C1A3E8F", "your-client-secret"

def sign(*parts):
    return hashlib.sha512("|".join(map(str, parts)).encode()).hexdigest()

body = {
    "clientId": CLIENT_ID, "orderId": "INV-1001", "totalAmount": 200000,
    "paymentType": "QRIS", "customerName": "Andi",
    "customerEmail": "[email protected]", "customerPhone": "6281234567890",
}
body["signature"] = sign(CLIENT_ID, body["orderId"], body["totalAmount"], CLIENT_SECRET)
res = requests.post(f"{BASE_URL}/api/order/create", json=body, timeout=40).json()
if res["code"] == 200:
    qr_string = res["data"]["qrString"]  # render as a QR code

$baseUrl = 'https://api.trustedpay.vip';
$clientId = '8F3C2A9E1B7D4C6A0E5F9B2D7C1A3E8F';
$clientSecret = 'your-client-secret';

$body = [
    'clientId' => $clientId, 'orderId' => 'INV-1001', 'totalAmount' => 200000,
    'paymentType' => 'QRIS', 'customerName' => 'Andi',
    'customerEmail' => '[email protected]', 'customerPhone' => '6281234567890',
];
$body['signature'] = hash('sha512', implode('|', [$clientId, $body['orderId'], $body['totalAmount'], $clientSecret]));

$ch = curl_init("$baseUrl/api/order/create");
curl_setopt_array($ch, [
    CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 40,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode($body),
]);
$res = json_decode(curl_exec($ch), true);

import { createHash } from "node:crypto";

const BASE_URL = "https://api.trustedpay.vip";
const CLIENT_ID = "8F3C2A9E1B7D4C6A0E5F9B2D7C1A3E8F", CLIENT_SECRET = "your-client-secret";
const sign = (...p) => createHash("sha512").update(p.join("|")).digest("hex");

const body = {
  clientId: CLIENT_ID, orderId: "INV-1001", totalAmount: 200000, paymentType: "QRIS",
  customerName: "Andi", customerEmail: "[email protected]", customerPhone: "6281234567890",
};
body.signature = sign(CLIENT_ID, body.orderId, body.totalAmount, CLIENT_SECRET);
const res = await (await fetch(`${BASE_URL}/api/order/create`, {
  method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body),
})).json();

{
  "code": 200,
  "message": "Success",
  "data": {
    "refCode": "PX261021003514CR1RE6",
    "transactionTime": "2026-10-21 00:35:14",
    "orderId": "INV-1001",
    "totalAmount": 200000,
    "customerName": "Andi",
    "customerEmail": "[email protected]",
    "customerPhone": "6281234567890",
    "notifyUrl": "https://merchant.example/callback/trustedpay",
    "returnUrl": null,
    "status": "PENDING",
    "paidAt": null,
    "expiredAt": "2026-10-21 01:05:14",
    "qrString": "00020101021226610012ID.CO.QRIS.WWW…6304B896"
  }
}

curl -X POST https://api.trustedpay.vip/api/withdrawal/create \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "8F3C2A9E1B7D4C6A0E5F9B2D7C1A3E8F",
    "orderId": "WD-1001",
    "requestAmount": 50000,
    "method": "BANK_ACCOUNT",
    "bankCode": "014",
    "accountNumber": "1234567890",
    "accountName": "Andi Wijaya",
    "signature": "<SHA512(clientId|WD-1001|50000|clientSecret)>"
  }'

body = {
    "clientId": CLIENT_ID, "orderId": "WD-1001", "requestAmount": 50000,
    "method": "EWALLET", "ewalletCode": "DANA",
    "accountNumber": "081234567890", "accountName": "Andi Wijaya",
}
body["signature"] = sign(CLIENT_ID, body["orderId"], body["requestAmount"], CLIENT_SECRET)
res = requests.post(f"{BASE_URL}/api/withdrawal/create", json=body, timeout=90).json()

{
  "code": 200,
  "message": "Success",
  "data": {
    "refCode": "WX261021101502KD8Q2M",
    "orderId": "WD-1001",
    "accountNumber": "1234567890",
    "accountName": "ANDI WIJAYA",
    "bank": { "name": "BCA (Bank Central Asia)", "code": "014" },
    "requestAmount": "50000.00",
    "withdrawalFee": "1600.00",
    "withdrawalAmount": "51600.00",
    "status": "PENDING",
    "statusRemark": null,
    "requestAt": "2026-10-21 10:15:02",
    "processedAt": null,
    "payoutProvider": "TRUSTEDPAY",
    "method": "BANK_ACCOUNT"
  }
}

{
  "payoutProvider": "TRUSTEDPAY",
  "method": "BANK_ACCOUNT",
  "pendingBalance": "34580.00",
  "availableBalance": "144000.00",
  "withdrawalFee": "1600.00",
  "maxRequestAmount": "142400.00",
  "hasBalance": true
}

{
  "clientId": "8F3C2A9E1B7D4C6A0E5F9B2D7C1A3E8F",
  "orderId": "INV-1001",
  "refCode": "PX261021003514CR1RE6",
  "totalAmount": 200000,
  "status": "PAID",
  "paidAt": "2026-10-21 00:37:07",
  "rrn": "AX4UEDYO2VXN",
  "signature": "SHA512(clientId|orderId|refCode|status|clientSecret)"
}

{
  "clientId": "8F3C2A9E1B7D4C6A0E5F9B2D7C1A3E8F",
  "refCode": "WX261021101502KD8Q2M",
  "orderId": "WD-1001",
  "accountNumber": "1234567890",
  "accountName": "ANDI WIJAYA",
  "bank": { "name": "BCA (Bank Central Asia)", "code": "014" },
  "method": "BANK_ACCOUNT",
  "requestAmount": "50000.00",
  "withdrawalFee": "1600.00",
  "withdrawalAmount": "51600.00",
  "status": "SUCCESS",
  "statusRemark": null,
  "requestAt": "2026-10-21 10:15:02",
  "processedAt": "2026-10-21 10:15:31",
  "signature": "SHA512(clientId|orderId|refCode|status|clientSecret)"
}

import hashlib, hmac
from flask import Flask, request

app = Flask(__name__)

@app.post("/callback/trustedpay")
def trustedpay_callback():
    cb = request.get_json(force=True)
    expected = hashlib.sha512(
        "|".join([cb["clientId"], cb["orderId"], cb["refCode"], cb["status"], CLIENT_SECRET]).encode()
    ).hexdigest()
    if cb["clientId"] != CLIENT_ID or not hmac.compare_digest(expected, cb.get("signature", "").lower()):
        return {"ok": False}, 401
    # idempotent: skip if (refCode, status) was already handled
    handle(cb)
    return {"ok": True}, 200

$cb = json_decode(file_get_contents('php://input'), true);
$expected = hash('sha512', implode('|', [$cb['clientId'], $cb['orderId'], $cb['refCode'], $cb['status'], $clientSecret]));

if ($cb['clientId'] !== $clientId || !hash_equals($expected, strtolower($cb['signature'] ?? ''))) {
    http_response_code(401);
    exit;
}
// idempotent: skip if (refCode, status) was already handled
handle($cb);
http_response_code(200);
echo json_encode(['ok' => true]);

import express from "express";
import { createHash, timingSafeEqual } from "node:crypto";

const app = express();
app.post("/callback/trustedpay", express.json(), (req, res) => {
  const cb = req.body;
  const expected = createHash("sha512")
    .update([cb.clientId, cb.orderId, cb.refCode, cb.status, CLIENT_SECRET].join("|")).digest("hex");
  const given = String(cb.signature || "").toLowerCase();
  const ok = cb.clientId === CLIENT_ID && given.length === expected.length &&
    timingSafeEqual(Buffer.from(given), Buffer.from(expected));
  if (!ok) return res.status(401).json({ ok: false });
  handle(cb); // idempotent by refCode + status
  res.json({ ok: true });
});