How do I integrate the SekaliPay API?

A SekaliPay integration needs three things: POST /payment to create a payment, one endpoint on your server to receive the webhook when it is paid, and GET /payment/{merchant_ref_id} to check its status at any time. Everything is HTTPS with JSON responses, authenticated with an API key header and an HMAC-SHA256 signature.

This page was checked against the API code as of October 16, 2026.

What does one payment look like end to end?#

Your server creates a payment
POST /payment with the amount, method code, and buyer details. The response contains the invoice, a payment_link, and method-specific payment details: a QR image, a VA number, or a checkout link.
The buyer pays
Send the buyer to payment_link, or render the QR or VA number from the response yourself. The payment is valid for 30 minutes.
SekaliPay sends a webhook
As soon as the payment is confirmed, our server sends a signed POST to your callback_url with status paid.
The buyer returns to your store
The payment page redirects the buyer's browser to your return_url. This redirect is for the buyer's convenience only and is not proof of payment.
You reconcile
If a webhook has not arrived, GET /payment/{merchant_ref_id} returns the latest status.

What is the base URL?#

Every endpoint lives under the base URL below. Sandbox and production use the same URL and the same keys; only the account mode in the dashboard differs (see Sandbox).

Base URL

https://sekalipay.com/api/v1/gateway

Which rules apply to every endpoint?#

Topic	Rule
Format	Request and response bodies are JSON. Send `Content-Type: application/json`.
`Accept` header	Always send `Accept: application/json`. Without it, validation errors come back as a `302` redirect to the home page instead of a JSON `422`.
Amounts	Whole rupiah integers without decimals: `150000`, not `150000.00`.
Times	`expired_at`, `created_at`, and `paid_at` in API responses use ISO 8601 UTC, e.g. `2026-10-08T08:30:00.000000Z`. `paid_at` in webhooks uses `Y-m-d H:i:s` in WIB without a zone.
Success responses	`{"status": true, "message": "OK", "data": {...}}`. Exception: account info uses an older shape.
Error responses	The error code is in `message` (endpoint errors) or `error_code` (authentication errors). See error shapes.
Branching	Decide on the HTTP status and error code, never on message text. Text may be in English or Indonesian and may change.

Which endpoints are available?#

Method	Path	Purpose	Limit per minute	Signature
POST	/payment	Create payment	5	Required in both modes
GET	/payment/{merchant_ref_id}	Payment status	30	Enhanced HMAC only
GET	/payment-methods	Payment methods	60	Enhanced HMAC only
GET	/merchant/info	Account info	60	Enhanced HMAC only
POST	/withdrawal	Withdrawals	2	Required in both modes

Where should I start?#

Ready to use your own keys?

Sign in to the merchant dashboard to copy your API key and secret key, set the access mode and webhook URL, and download a Postman collection with your account's keys.