PHP

<?php

  $payload = json_encode([
    'amount' => 25000,
    'merchant_order_id' => 'ORDER-001',
    'customer_name' => 'John Doe',
  ]);

  $ch = curl_init('https://webqris.com/api/payments/qris/create');
  curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
      'Authorization: Bearer YOUR_API_TOKEN',
      'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $payload,
  ]);

  $response = curl_exec($ch);
  $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
  curl_close($ch);

  $data = json_decode($response, true);

JavaScript / Node.js (Express)

app.post('/payments/create-qris', async (req, res) => {
  const response = await fetch('https://webqris.com/api/payments/qris/create', {
    method: 'POST',
    headers: {
      'Authorization': 'Bearer ' + process.env.WEBQRIS_API_TOKEN,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      amount: req.body.amount,
      merchant_order_id: req.body.merchant_order_id,
      customer_name: req.body.customer_name,
    }),
  });

  const data = await response.json();
  return res.status(response.status).json(data);
});

React / Next.js (aman via backend sendiri)

// app/api/webqris/create/route.ts
export async function POST(request: Request) {
  const body = await request.json();

  const response = await fetch('https://webqris.com/api/payments/qris/create', {
    method: 'POST',
    headers: {
      'Authorization': 'Bearer ' + process.env.WEBQRIS_API_TOKEN,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(body),
  });

  return Response.json(await response.json(), { status: response.status });
}

// Komponen React memanggil backend Anda sendiri, bukan WebQRIS langsung.
const resp = await fetch('/api/webqris/create', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: 25000, merchant_order_id: 'ORDER-001' }),
});

Laravel

<?php

  namespace AppHttpControllers;

  use IlluminateHttpRequest;
  use IlluminateSupportFacadesHttp;

  class WebqrisPaymentController extends Controller
  {
    public function create(Request $request)
    {
      $response = Http::withToken(config('services.webqris.token'))
        ->post(config('services.webqris.base_url') . '/api/payments/qris/create', [
          'amount' => (int) $request->input('amount'),
          'merchant_order_id' => $request->input('merchant_order_id'),
          'customer_name' => $request->input('customer_name'),
        ]);

      return response()->json($response->json(), $response->status());
    }
  }

CodeIgniter 4

<?php

  namespace AppControllers;

  use CodeIgniterHTTPResponseInterface;
  use ConfigServices;

  class WebqrisPaymentController extends BaseController
  {
    public function create(): ResponseInterface
    {
      $client = Services::curlrequest();
      $response = $client->post(env('webqris.baseUrl') . '/api/payments/qris/create', [
        'headers' => [
          'Authorization' => 'Bearer ' . env('webqris.apiToken'),
          'Content-Type' => 'application/json',
        ],
        'json' => [
          'amount' => (int) $this->request->getJSON(true)['amount'],
          'merchant_order_id' => $this->request->getJSON(true)['merchant_order_id'] ?? null,
          'customer_name' => $this->request->getJSON(true)['customer_name'] ?? null,
        ],
      ]);

      return $this->response
        ->setStatusCode($response->getStatusCode())
        ->setJSON(json_decode($response->getBody(), true));
    }
  }

PHP

<?php

  $invoiceId = 'INV-1710000000-abc123';

  $ch = curl_init('https://webqris.com/api/payments/' . urlencode($invoiceId) . '/status');
  curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
      'Authorization: Bearer YOUR_API_TOKEN',
    ],
  ]);

  $response = curl_exec($ch);
  $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
  curl_close($ch);

  $data = json_decode($response, true);

JavaScript / Node.js (Express)

app.get('/payments/:invoiceId/status', async (req, res) => {
  const response = await fetch(
    'https://webqris.com/api/payments/' + encodeURIComponent(req.params.invoiceId) + '/status',
    {
      headers: {
        'Authorization': 'Bearer ' + process.env.WEBQRIS_API_TOKEN,
      },
    }
  );

  const data = await response.json();
  return res.status(response.status).json(data);
});

React / Next.js (aman via backend sendiri)

// app/api/webqris/status/[invoiceId]/route.ts
export async function GET(
  _request: Request,
  { params }: { params: { invoiceId: string } }
) {
  const response = await fetch(
    'https://webqris.com/api/payments/' + encodeURIComponent(params.invoiceId) + '/status',
    {
      headers: {
        'Authorization': 'Bearer ' + process.env.WEBQRIS_API_TOKEN,
      },
      cache: 'no-store',
    }
  );

  return Response.json(await response.json(), { status: response.status });
}

// Komponen React cukup memanggil endpoint backend Anda sendiri.
const resp = await fetch('/api/webqris/status/' + invoiceId);

Laravel

<?php

  namespace AppHttpControllers;

  use IlluminateSupportFacadesHttp;

  class WebqrisStatusController extends Controller
  {
    public function show(string $invoiceId)
    {
      $response = Http::withToken(config('services.webqris.token'))
        ->get(config('services.webqris.base_url') . '/api/payments/' . $invoiceId . '/status');

      return response()->json($response->json(), $response->status());
    }
  }

CodeIgniter 4

<?php

  namespace AppControllers;

  use CodeIgniterHTTPResponseInterface;
  use ConfigServices;

  class WebqrisStatusController extends BaseController
  {
    public function show(string $invoiceId): ResponseInterface
    {
      $client = Services::curlrequest();
      $response = $client->get(env('webqris.baseUrl') . '/api/payments/' . $invoiceId . '/status', [
        'headers' => [
          'Authorization' => 'Bearer ' . env('webqris.apiToken'),
        ],
      ]);

      return $this->response
        ->setStatusCode($response->getStatusCode())
        ->setJSON(json_decode($response->getBody(), true));
    }
  }

import crypto from 'node:crypto';

// app/api/webhook/qris/route.ts
export async function POST(request: Request) {
  const signature = request.headers.get('x-webhook-signature') ?? '';
  const body = await request.text();
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET || '')
    .update(body)
    .digest('hex');

  if (signature !== expected) {
    return Response.json({ success: false, message: 'Invalid signature' }, { status: 401 });
  }

  const payload = JSON.parse(body);
  if (payload.event !== 'payment.paid') {
    return Response.json({ success: false, message: 'Invalid event' }, { status: 400 });
  }

  const payment = payload.data || {};

  // TODO: update order di database Anda.

  return Response.json({
    success: true,
    invoice_id: payment.invoice_id,
    merchant_order_id: payment.merchant_order_id,
    status: payment.status,
  });
}

// React frontend tidak menerima webhook langsung.
// Frontend cukup membaca status dari backend Anda sendiri.

<?php

  use IlluminateHttpRequest;
  use IlluminateSupportFacadesLog;
  use IlluminateSupportFacadesRoute;

  Route::post('/webhook/qris', function (Request $request) {
    $signature = $request->header('X-Webhook-Signature', '');
    $body = $request->getContent();
    $expected = hash_hmac('sha256', $body, env('WEBHOOK_SECRET'));

    if (!hash_equals($expected, $signature)) {
      return response()->json([
        'success' => false,
        'message' => 'Invalid signature',
      ], 401);
    }

    $payload = json_decode($body, true);
    if (($payload['event'] ?? '') !== 'payment.paid') {
      return response()->json([
        'success' => false,
        'message' => 'Invalid event',
      ], 400);
    }

    $payment = $payload['data'] ?? [];

    // TODO: cocokkan invoice/order di database Anda.
    Log::info('WebQRIS payment paid', $payment);

    return response()->json([
      'success' => true,
      'invoice_id' => $payment['invoice_id'] ?? null,
      'merchant_order_id' => $payment['merchant_order_id'] ?? null,
      'status' => $payment['status'] ?? null,
    ]);
  });

Route + Controller Laravel (Versi Terpisah)

// routes/api.php
  use AppHttpControllersWebqrisWebhookController;

  Route::post('/webhook/qris', [WebqrisWebhookController::class, 'paid']);

  // app/Http/Controllers/WebqrisWebhookController.php
  namespace AppHttpControllers;

  use IlluminateHttpRequest;
  use IlluminateSupportFacadesLog;

  class WebqrisWebhookController extends Controller
  {
    public function paid(Request $request)
    {
      $signature = $request->header('X-Webhook-Signature', '');
      $body = $request->getContent();
      $expected = hash_hmac('sha256', $body, env('WEBHOOK_SECRET'));

      if (!hash_equals($expected, $signature)) {
        return response()->json(['success' => false, 'message' => 'Invalid signature'], 401);
      }

      $payload = json_decode($body, true);
      $payment = $payload['data'] ?? [];
      Log::info('WebQRIS payment paid', $payment);

      return response()->json(['success' => true]);
    }
  }

<?php

  namespace AppControllers;

  use CodeIgniterHTTPResponseInterface;

  class WebqrisWebhook extends BaseController
  {
    public function paid(): ResponseInterface
    {
      $signature = $this->request->getHeaderLine('X-Webhook-Signature');
      $body = $this->request->getBody();
      $expected = hash_hmac('sha256', $body, env('webqris.webhookSecret'));

      if (!hash_equals($expected, $signature)) {
        return $this->response
          ->setStatusCode(401)
          ->setJSON([
            'success' => false,
            'message' => 'Invalid signature',
          ]);
      }

      $payload = json_decode($body, true);
      if (($payload['event'] ?? '') !== 'payment.paid') {
        return $this->response
          ->setStatusCode(400)
          ->setJSON([
            'success' => false,
            'message' => 'Invalid event',
          ]);
      }

      $payment = $payload['data'] ?? [];

      // TODO: cocokkan invoice/order di database Anda.

      return $this->response->setJSON([
        'success' => true,
        'invoice_id' => $payment['invoice_id'] ?? null,
        'merchant_order_id' => $payment['merchant_order_id'] ?? null,
        'status' => $payment['status'] ?? null,
      ]);
    }
  }

Route + Controller CodeIgniter 4 (Versi Terpisah)

// app/Config/Routes.php
    $routes->post('webhook/qris', 'WebqrisWebhook::paid');

    // app/Controllers/WebqrisWebhook.php
    namespace AppControllers;

    class WebqrisWebhook extends BaseController
    {
      public function paid()
      {
        $signature = $this->request->getHeaderLine('X-Webhook-Signature');
        $body = $this->request->getBody();
        $expected = hash_hmac('sha256', $body, env('webqris.webhookSecret'));

        if (!hash_equals($expected, $signature)) {
          return $this->response->setStatusCode(401)->setJSON([
            'success' => false,
            'message' => 'Invalid signature',
          ]);
        }

        $payload = json_decode($body, true);
        $payment = $payload['data'] ?? [];

        return $this->response->setJSON([
          'success' => true,
          'invoice_id' => $payment['invoice_id'] ?? null,
        ]);
      }
    }

PHP

<?php

  $payload = json_encode([
    'amount' => 25042,
    'sender_name' => 'JOHN DOE',
    'reference' => 'optional-reference',
  ]);

  $ch = curl_init('https://webqris.com/api/callback/notify');
  curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
      'X-Callback-Key: YOUR_CALLBACK_SECRET',
      'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $payload,
  ]);

  $response = curl_exec($ch);
  curl_close($ch);

JavaScript / Node.js (Express)

app.post('/forward-qris-notify', async (req, res) => {
  const response = await fetch('https://webqris.com/api/callback/notify', {
    method: 'POST',
    headers: {
      'X-Callback-Key': process.env.WEBQRIS_CALLBACK_SECRET,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      amount: req.body.amount,
      sender_name: req.body.sender_name,
      reference: req.body.reference,
    }),
  });

  const data = await response.json();
  return res.status(response.status).json(data);
});

React / Next.js (aman via backend sendiri)

// app/api/webqris/callback-notify/route.ts
export async function POST(request: Request) {
  const body = await request.json();

  const response = await fetch('https://webqris.com/api/callback/notify', {
    method: 'POST',
    headers: {
      'X-Callback-Key': process.env.WEBQRIS_CALLBACK_SECRET || '',
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(body),
  });

  return Response.json(await response.json(), { status: response.status });
}

// React frontend memanggil backend Anda sendiri, jangan expose callback secret ke browser.

Laravel

<?php

  use IlluminateSupportFacadesHttp;

  $response = Http::withHeaders([
    'X-Callback-Key' => config('services.webqris.callback_secret'),
  ])->post(config('services.webqris.base_url') . '/api/callback/notify', [
    'amount' => 25042,
    'sender_name' => 'JOHN DOE',
    'reference' => 'optional-reference',
  ]);

  $data = $response->json();

CodeIgniter 4

<?php

  $client = ConfigServices::curlrequest();
  $response = $client->post(env('webqris.baseUrl') . '/api/callback/notify', [
    'headers' => [
      'X-Callback-Key' => env('webqris.callbackSecret'),
      'Content-Type' => 'application/json',
    ],
    'json' => [
      'amount' => 25042,
      'sender_name' => 'JOHN DOE',
      'reference' => 'optional-reference',
    ],
  ]);

  $data = json_decode($response->getBody(), true);