How does SekaliPay API authentication work?

$body = json_encode([
    'merchant_ref_id' => 'ORDER-2026-00184',
    'amount'          => 150000,
    'payment_code'    => 'QRIS',
    'customer_name'   => 'Budi Santoso',
    'customer_email'  => '[email protected]',
    'customer_phone'  => '081234567890',
    'callback_url'    => 'https://toko-anda.id/webhook/sekalipay',
    'return_url'      => 'https://toko-anda.id/checkout/selesai',
]);

$signature = hash_hmac('sha256', $body, getenv('SEKALIPAY_SECRET_KEY'));

$ch = curl_init('https://sekalipay.com/api/v1/gateway/payment');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $body,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'Accept: application/json',
        'X-API-Key: ' . getenv('SEKALIPAY_API_KEY'),
        'X-Signature: ' . $signature,
    ],
]);

$response = json_decode(curl_exec($ch), true);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

import { createHmac } from "node:crypto";

const body = JSON.stringify({
  "merchant_ref_id": "ORDER-2026-00184",
  "amount": 150000,
  "payment_code": "QRIS",
  "customer_name": "Budi Santoso",
  "customer_email": "[email protected]",
  "customer_phone": "081234567890",
  "callback_url": "https://toko-anda.id/webhook/sekalipay",
  "return_url": "https://toko-anda.id/checkout/selesai"
});

const signature = createHmac("sha256", process.env.SEKALIPAY_SECRET_KEY)
  .update(body)
  .digest("hex");

const res = await fetch("https://sekalipay.com/api/v1/gateway/payment", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Accept: "application/json",
    "X-API-Key": process.env.SEKALIPAY_API_KEY,
    "X-Signature": signature,
  },
  body,
});

const result = await res.json();

BODY='{"merchant_ref_id":"ORDER-2026-00184","amount":150000,"payment_code":"QRIS","customer_name":"Budi Santoso","customer_email":"[email protected]","customer_phone":"081234567890","callback_url":"https://toko-anda.id/webhook/sekalipay","return_url":"https://toko-anda.id/checkout/selesai"}'
SIGNATURE=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$SEKALIPAY_SECRET_KEY" | sed 's/^.* //')

curl -X POST https://sekalipay.com/api/v1/gateway/payment \
  -H "X-API-Key: $SEKALIPAY_API_KEY" \
  -H "X-Signature: $SIGNATURE" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  --data-raw "$BODY"

function phpUrlencode(value) {
  return encodeURIComponent(value)
    .replace(/[!'()*~]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase())
    .replace(/%20/g, "+");
}

function buildParams(params) {
  const parts = [];
  const add = (prefix, value) => {
    if (typeof value === "string") value = value.trim();
    if (value === null || value === undefined || value === "") return;
    if (typeof value === "object") {
      for (const key of Object.keys(value)) add(prefix + "%5B" + phpUrlencode(key) + "%5D", value[key]);
      return;
    }
    if (value === true) value = "1";
    else if (value === false) value = "0";
    parts.push(prefix + "=" + phpUrlencode(String(value)));
  };
  for (const key of Object.keys(params).sort()) add(phpUrlencode(key), params[key]);
  return parts.join("&");
}

async function hmacSha256Hex(secret, message) {
  const enc = new TextEncoder();
  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(message));
  return [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, "0")).join("");
}

export async function sekalipay(method, path, payload, { apiKey, secretKey }) {
  const timestamp = Math.floor(Date.now() / 1000);
  const stringToSign = method + "|" + path + "|" + buildParams(payload ?? {}) + "|" + timestamp;
  const signature = await hmacSha256Hex(secretKey, stringToSign);

  const res = await fetch("https://sekalipay.com/" + path, {
    method,
    headers: {
      "Content-Type": "application/json",
      Accept: "application/json",
      "X-API-Key": apiKey,
      "X-Signature": signature,
      "X-Timestamp": String(timestamp),
    },
    body: method === "GET" ? undefined : JSON.stringify(payload),
  });

  return { status: res.status, body: await res.json() };
}

const keys = { apiKey: SEKALIPAY_API_KEY, secretKey: SEKALIPAY_SECRET_KEY };

await sekalipay("POST", "api/v1/gateway/payment", {
  merchant_ref_id: "ORDER-2026-00184",
  amount: 150000,
  payment_code: "QRIS",
  customer_name: "Budi Santoso",
  customer_email: "[email protected]",
  customer_phone: "081234567890",
}, keys);

await sekalipay("GET", "api/v1/gateway/payment/ORDER-2026-00184", null, keys);

function sekalipay(string $method, string $path, array $payload = []): array
{
    $timestamp = time();
    $params = $payload;
    array_walk_recursive($params, function (&$value) {
        if (is_string($value)) {
            $value = trim($value) === '' ? null : trim($value);
        }
    });
    ksort($params);

    $stringToSign = $method . '|' . $path . '|' . http_build_query($params) . '|' . $timestamp;
    $signature = hash_hmac('sha256', $stringToSign, getenv('SEKALIPAY_SECRET_KEY'));

    $ch = curl_init('https://sekalipay.com/' . $path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            'Content-Type: application/json',
            'Accept: application/json',
            'X-API-Key: ' . getenv('SEKALIPAY_API_KEY'),
            'X-Signature: ' . $signature,
            'X-Timestamp: ' . $timestamp,
        ],
    ]);

    if ($method !== 'GET') {
        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
    }

    $body = curl_exec($ch);

    return [curl_getinfo($ch, CURLINFO_HTTP_CODE), json_decode($body, true)];
}

sekalipay('POST', 'api/v1/gateway/payment', [
    'merchant_ref_id' => 'ORDER-2026-00184',
    'amount'          => 150000,
    'payment_code'    => 'QRIS',
    'customer_name'   => 'Budi Santoso',
    'customer_email'  => '[email protected]',
    'customer_phone'  => '081234567890',
]);

sekalipay('GET', 'api/v1/gateway/payment/ORDER-2026-00184');