Panduan Integrasi BCA Payment Gateway

# 1. Membuat invoice BCA QRIS Dinamis
curl -X POST https://bca.5nod.com/api/v1/charge \
  -H "Authorization: Bearer BCA-GW-YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "external_id": "ORDER-100249",
    "amount": 10000,
    "acquirer": "bca",
    "webhook_url": "https://toko-anda.com/api/webhook-bca"
  }'

# 2. Memeriksa status transaksi
curl -X GET https://bca.5nod.com/api/v1/status/ORDER-100249 \
  -H "Authorization: Bearer BCA-GW-YOUR_API_KEY"

<?php
// Membuat Invoice BCA QRIS Dinamis (PHP cURL)
$url = "https://bca.5nod.com/api/v1/charge";
$apiKey = "BCA-GW-YOUR_API_KEY";

$payload = [
    "external_id" => "ORDER-" . time(),
    "amount"      => 10000,
    "acquirer"    => "bca",
    "webhook_url" => "https://toko-anda.com/api/webhook-bca"
];

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode($payload),
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer " . $apiKey,
        "Content-Type: application/json"
    ],
    CURLOPT_TIMEOUT        => 20
]);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

$data = json_decode($response, true);
if ($httpCode === 201 && isset($data['qris_image'])) {
    echo "<h3>Total Bayar: Rp " . number_format($data['amount'], 0, ',', '.') . "</h3>";
    echo '<img src="' . htmlspecialchars($data['qris_image']) . '" alt="QRIS BCA" width="240" />';
} else {
    echo "Gagal membuat invoice: " . ($data['message'] ?? 'Unknown error');
}
?>

// Membuat Invoice & Cek Status dengan Fetch bawaan Node.js 18+
const BASE_URL = 'https://bca.5nod.com';
const API_KEY = 'BCA-GW-YOUR_API_KEY';

async function createInvoice() {
  const res = await fetch(`${BASE_URL}/api/v1/charge`, {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${API_KEY}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      external_id: 'ORDER-' + Date.now(),
      amount: 10000,
      acquirer: 'bca',
      webhook_url: 'https://toko-anda.com/api/webhook-bca'
    })
  });

  const data = await res.json();
  if (!res.ok) throw new Error(data.message || 'Gagal membuat invoice');

  console.log('Nominal Unik (IDR):', data.amount);
  console.log('Routing Bank:', data.active_acquirers);
  console.log('QR String:', data.qris_string);
  return data;
}

createInvoice().catch(console.error);

<?php
// Contoh Endpoint Penerima Webhook di Server Toko (PHP)
// URL: https://toko-anda.com/api/webhook-bca

$rawBody = file_get_contents('php://input');
$payload = json_decode($rawBody, true);

if (!$payload || empty($payload['external_id']) || ($payload['status'] ?? '') !== 'success') {
    http_response_code(400);
    echo json_encode(['ok' => false, 'message' => 'Payload tidak valid']);
    exit;
}

$externalId = $payload['external_id'];
$amountPaid = (float) ($payload['amount'] ?? 0);

// 1. Verifikasi silang ke Gateway API agar 100% aman dari request palsu
$ch = curl_init("https://bca.5nod.com/api/v1/status/" . urlencode($externalId));
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ["Authorization: Bearer BCA-GW-YOUR_API_KEY"]
]);
$verifyJson = json_decode(curl_exec($ch), true);
curl_close($ch);

if (($verifyJson['status'] ?? '') === 'success' && (float)$verifyJson['amount'] === $amountPaid) {
    // 2. Tandai order sebagai LUNAS di database toko Anda (secara idempoten)
    // updateOrderPaid($externalId);
    http_response_code(200);
    echo json_encode(['ok' => true]);
} else {
    http_response_code(400);
    echo json_encode(['ok' => false, 'message' => 'Verifikasi status gagal']);
}
?>

// Contoh Endpoint Penerima Webhook di Server Toko (Node.js Express)
const express = require('express');
const app = express();
app.use(express.json());

const GATEWAY_URL = 'https://bca.5nod.com';
const API_KEY = 'BCA-GW-YOUR_API_KEY';

app.post('/api/webhook-bca', async (req, res) => {
  const { external_id, amount, status } = req.body || {};

  if (!external_id || status !== 'success') {
    return res.status(400).json({ ok: false, message: 'Payload tidak valid' });
  }

  try {
    // Verifikasi ulang ke Gateway API untuk memastikan pembayaran asli
    const verifyRes = await fetch(`${GATEWAY_URL}/api/v1/status/${encodeURIComponent(external_id)}`, {
      headers: { 'Authorization': `Bearer ${API_KEY}` }
    });
    const tx = await verifyRes.json();

    if (verifyRes.ok && tx.status === 'success' && Number(tx.amount) === Number(amount)) {
      // TODO: Update status order di database toko Anda menjadi PAID (idempoten)
      console.log(`Order ${external_id} lunas sebesar Rp ${amount}`);
      return res.status(200).json({ ok: true });
    }
    return res.status(400).json({ ok: false, message: 'Status transaksi belum lunas' });
  } catch (err) {
    return res.status(500).json({ ok: false, message: err.message });
  }
});