QRISGate REST API Reference

{
  "event": "payment.paid",
  "transaction_id": "trx_8f2c4b1a05c67e1f7294b3d0",
  "external_order_id": "INV-1042",
  "base_amount": 150000,
  "unique_code": 247,
  "total_amount": 150247,
  "customer_name": "Budi",
  "paid_at": "2026-10-24T09:15:22.000Z",
  "created_at": "2026-10-24T09:12:40.000Z"
}

Payload bersifat flat — tidak ada wrapper data. Baca external_order_id langsung di level atas.

const crypto = require('crypto');
const express = require('express');
const app = express();

// express.raw() gives you the EXACT bytes QRISGate signed. Any JSON body
// parser (express.json(), body-parser) destroys that serialisation, and the
// signature will never match.
app.post('/api/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-qrisgate-signature'];
  const timestamp = req.headers['x-qrisgate-timestamp'];
  const secret    = process.env.QRISGATE_WEBHOOK_SECRET;

  // 1. Replay window — reject anything signed more than 5 minutes ago.
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(401).send('Stale timestamp');
  }

  // 2. HMAC over the RAW body — never over a re-serialised object.
  const expected = crypto
    .createHmac('sha256', secret)
    .update(timestamp + '.' + req.body)
    .digest('hex');

  // 3. Constant-time comparison, after a length check.
  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(String(signature).replace(/^sha256=/, ''), 'hex');
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send('Invalid signature');
  }

  // 4. The payload is FLAT. There is no `data` wrapper.
  const { event, external_order_id, total_amount } = JSON.parse(req.body.toString('utf8'));

  if (event === 'payment.paid') {
    // ... mark order external_order_id as paid for total_amount
  }

  res.json({ received: true });
});

Tiga hal yang paling sering salah: mem-verifikasi body hasil JSON.stringify(req.body) (harus byte mentah), membandingkan dengan !== (harus constant-time), dan tidak memeriksa timestamp (harus ditolak bila lebih tua dari 5 menit).