A payment API for websites and apps.
A REST API to create bills, check their status, and withdraw your balance. Your server creates a bill, the buyer pays, then SekaliPay Merchant sends a signed webhook to your server.
How does the flow work?
One bill, from the first request to the paid webhook.
Sequence diagram: your server sends POST /payment, SekaliPay Merchant replies 201 with payment_link and qr_link, the buyer pays from the link, SekaliPay Merchant sends a webhook with X-Signature, and your server replies 200.
BODY='{"merchant_ref_id":"ORDER-2026-00184","amount":150000,"payment_code":"QRIS","customer_name":"Budi Santoso","customer_email":"[email protected]","customer_phone":"081234567890","callback_url":"https://toko-anda.id/webhook/sekalipay","return_url":"https://toko-anda.id/checkout/selesai"}'
SIGNATURE=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$SEKALIPAY_SECRET_KEY" | sed 's/^.* //')
curl -X POST https://sekalipay.com/api/v1/gateway/payment \
-H "X-API-Key: $SEKALIPAY_API_KEY" \
-H "X-Signature: $SIGNATURE" \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
--data-raw "$BODY"{
"status": true,
"message": "OK",
"data": {
"merchant_ref_id": "ORDER-2026-00184",
"invoice": "SPY1791446400K3QZ",
"amount": 150000,
"fee": 1500,
"total": 151500,
"payment_code": "QRIS",
"payment_link": "https://sekalipay.com/payment/SPY1791446400K3QZ",
"qr_link": "https://sekalipay.com/payment/SPY1791446400K3QZ/qris",
"virtual_account": null,
"checkout_url": null,
"payment_guide": null,
"expired_at": "2026-10-08T08:30:00.000000Z",
"status": "pending",
"is_sandbox": false
}
}{
"merchant_ref_id": "ORDER-2026-00184",
"invoice": "SPY1791446400K3QZ",
"amount": 150000,
"fee": 1500,
"total": 151500,
"status": "paid",
"paid_at": "2026-10-08 15:05:12"
}Bills are valid for 30 minutes. Full fields and PHP and Node.js examples are in the documentation.
Security and reliability
- Authentication
- API key in the X-API-Key header, HMAC-SHA256 signature with your secret key. Choose IP Whitelist, or Enhanced HMAC with X-Timestamp (300 second window) for servers without a fixed IP.
- Webhook verification
- Every webhook carries X-Signature, an HMAC-SHA256 over the raw body. Match it with your secret key before processing.
- Webhook retries
- Up to 3 attempts, waiting 30 seconds then 5 minutes. Each attempt times out after 120 seconds.
- Sandbox
- An account mode, not separate keys. Same URL and keys; test transactions are flagged is_sandbox and never reach your balance.
Start integrating in six steps
- 1
Get your API key and secret key
In the dashboard under API Settings. The secret key is shown after PIN verification.
- 2
Choose an access mode
IP Whitelist for servers with a fixed IP, Enhanced HMAC for those without.
- 3
Set the webhook URL
A public address on your server. Override it per bill with callback_url.
- 4
Enable payment methods
Only enabled methods are accepted by the API.
- 5
Test in sandbox mode
Create a test bill and make sure the webhook verifies.
- 6
Go to production
Turn sandbox mode off. Keys and URLs stay the same.
Available endpoints
All under the base URL https://sekalipay.com/api/v1/gateway.
- POST
/paymentCreate a new bill - GET
/payment/{merchant_ref_id}Check a bill's status - GET
/payment-methodsActive methods, amount limits, settlement time, and fees - GET
/merchant/infoAvailable balance, held balance, and account status - POST
/withdrawalWithdraw balance to a bank account
Registered with PSE Komdigi
023936.01/DJAI.PSE/06/2026
Start accepting payments.
Sign up today. Once verification is done in 1 to 2 business days, you can send your first bill right away.