Autentikasi dan format

Base URL: https://zapay.zannmods.net/api/v1. Semua request memakai header Authorization: Bearer API_KEY (API key per project dari halaman Project). Panggil hanya dari server Anda. Body POST berupa JSON.

Respons sukses: {"success":true,"data":{...}}. Respons gagal: {"success":false,"error":{"code":"...","message":"..."}}. Batas 60 request per menit per project (HTTP 429).

Status transaksi: pending, paid, expired, canceled, failed. Dana paid masuk saldo pending dan dirilis ke saldo utama setelah 25 jam.

POST /api/v1/createtransaksi

Membuat transaksi pembayaran QRIS atau virtual account. order_id harus unik per project (idempotensi).

Contoh request

curl -X POST https://zapay.zannmods.net/api/v1/createtransaksi -H "Authorization: Bearer zp_API_KEY_ANDA" -H "Content-Type: application/json" \
  -d '{"order_id":"INV-1001","amount":50000,"method":"bca","customer_name":"Budi","description":"Topup"}'

Contoh respons

{"success":true,"data":{"order_id":"INV-1001","status":"pending","method":"bca","amount":50000,"fee":5000,"net":45000,
 "description":"Topup","pay_url":"https://zapay.zannmods.net/pay/3f2a...","payment":{"va_number":"812785002530231","expires_at":"2026-11-07 10:00:00"},
 "created_at":"2026-11-06 10:00:00","paid_at":null}}

GET /api/v1/statustransaksi

Cek status satu transaksi. Jika masih pending, Zapay menyinkronkan ke penyedia lebih dulu, jadi aman dipakai untuk rekonsiliasi.

Contoh request

curl "https://zapay.zannmods.net/api/v1/statustransaksi?order_id=INV-1001" -H "Authorization: Bearer zp_API_KEY_ANDA"

Contoh respons

{"success":true,"data":{"order_id":"INV-1001","status":"pending","method":"bca","amount":50000,"fee":5000,"net":45000,
 "description":"Topup","pay_url":"https://zapay.zannmods.net/pay/3f2a...","payment":{"va_number":"812785002530231","expires_at":"2026-11-07 10:00:00"},
 "created_at":"2026-11-06 10:00:00","paid_at":null}}

POST /api/v1/batalkantransaksi

Membatalkan transaksi berstatus pending. Webhook payment.canceled dikirim setelah berhasil.

Contoh request

curl -X POST https://zapay.zannmods.net/api/v1/batalkantransaksi -H "Authorization: Bearer zp_API_KEY_ANDA" -H "Content-Type: application/json" -d '{"order_id":"INV-1001"}'

Contoh respons

{"success":true,"data":{"order_id":"INV-1001","status":"canceled","method":"bca","amount":50000,"fee":5000,"net":45000,
 "description":"Topup","pay_url":"https://zapay.zannmods.net/pay/3f2a...","payment":{"va_number":"812785002530231","expires_at":"2026-11-07 10:00:00"},
 "created_at":"2026-11-06 10:00:00","paid_at":null}}

GET /api/v1/listtransaksi

Daftar transaksi project dengan pagination dan filter.

Contoh request

curl "https://zapay.zannmods.net/api/v1/listtransaksi?status=paid&page=1&limit=20" -H "Authorization: Bearer zp_API_KEY_ANDA"

Contoh respons

{"success":true,"data":{"items":[ /* objek transaksi */ ],"page":1,"limit":20,"total":42,"total_pages":3}}

GET /api/v1/saldo

Saldo akun pemilik project.

Contoh request

curl https://zapay.zannmods.net/api/v1/saldo -H "Authorization: Bearer zp_API_KEY_ANDA"

Contoh respons

{"success":true,"data":{"balance":120000,"pending":45000,"currency":"IDR","pending_release_hours":25}}

GET /api/v1/biaya

Hitung biaya sebelum membuat transaksi. QRIS: 0,7% + Rp250 di bawah Rp100.000, 1% mulai Rp100.000. Transfer bank: Rp5.000.

Contoh request

curl "https://zapay.zannmods.net/api/v1/biaya?method=qris&amount=50000" -H "Authorization: Bearer zp_API_KEY_ANDA"

Contoh respons

{"success":true,"data":{"method":"qris","amount":50000,"fee":600,"net":49400}}

GET /api/v1/metode

Daftar metode pembayaran yang tersedia beserta batasnya.

Contoh request

curl https://zapay.zannmods.net/api/v1/metode -H "Authorization: Bearer zp_API_KEY_ANDA"

Contoh respons

{"success":true,"data":[{"method":"qris","type":"qris","min":1000,"max":10000000,"fee":"0.7% + 250 (<100000), 1% (>=100000)"},{"method":"bca","type":"virtual_account","min":1000,"max":10000000,"fee":5000}]}

POST /api/v1/testwebhook

Mengirim event contoh payment.test ke URL webhook project untuk menguji endpoint dan verifikasi signature Anda.

Contoh request

curl -X POST https://zapay.zannmods.net/api/v1/testwebhook -H "Authorization: Bearer zp_API_KEY_ANDA" -H "Content-Type: application/json" -d '{}'

Contoh respons

{"success":true,"data":{"webhook_url":"https://tokoku.com/hook","http_status":200,"delivered":true}}

Mode Sandbox

Setiap project punya dua key: zp_... (live) dan zps_... (sandbox, ada di menu Sandbox). Endpoint dan format sama persis; yang berbeda hanya key-nya. Transaksi sandbox tidak menghubungi bank, tidak memotong atau menambah saldo, dan tidak muncul di dashboard live. VA dan QR berisi data simulasi (qr_string, bukan qr_url), dan semua objek transaksi punya "sandbox":true.

Ubah status lewat menu Sandbox, halaman pay_url (tombol simulasi), atau endpoint simulasi untuk tes otomatis. Webhook sandbox dikirim dengan field "sandbox":true dan ditandatangani memakai sandbox key. order_id sandbox dan live tidak saling bentrok.

POST /api/v1/simulasi

Hanya sandbox key. Mengubah transaksi pending menjadi paid, expired, atau failed dan mengirim webhook yang sesuai.

Contoh request

curl -X POST https://zapay.zannmods.net/api/v1/simulasi -H "Authorization: Bearer zp_API_KEY_ANDA" -H "Content-Type: application/json" -d '{"order_id":"INV-1001","status":"paid"}'

Contoh respons

{"success":true,"data":{"order_id":"INV-1001","status":"paid","method":"bca","amount":50000,"fee":5000,"net":45000,
 "description":"Topup","pay_url":"https://zapay.zannmods.net/pay/3f2a...","payment":{"va_number":"812785002530231","expires_at":"2026-11-07 10:00:00"},
 "created_at":"2026-11-06 10:00:00","paid_at":null}}

Webhook

Zapay mengirim POST JSON ke URL webhook project saat status berubah. Event: payment.paid, payment.expired, payment.canceled, payment.failed, payment.test. Balas HTTP 2xx. Notifikasi dikirim sekali; gunakan statustransaksi untuk rekonsiliasi bila endpoint Anda sempat down. Selalu verifikasi signature, jangan percaya halaman callback.

POST https://tokoku.com/hook
Content-Type: application/json
X-Zapay-Event: payment.paid
X-Zapay-Signature: <hex hmac-sha256 dari raw body, kunci = API key>

{"event":"payment.paid","order_id":"INV-1001","status":"paid","method":"qris","amount":50000,
 "fee":600,"net":49400,"paid_at":"2026-11-06 10:05:11","timestamp":1793000711}

PHP

$raw = file_get_contents('php://input');
$sig = hash_hmac('sha256', $raw, getenv('ZAPAY_API_KEY'));
if (!hash_equals($sig, $_SERVER['HTTP_X_ZAPAY_SIGNATURE'] ?? '')) { http_response_code(403); exit; }
$d = json_decode($raw, true);
if (abs(time() - $d['timestamp']) > 600) { http_response_code(400); exit; } // anti replay
if ($d['event'] === 'payment.paid') { /* tandai order lunas, idempotent berdasarkan order_id */ }
http_response_code(200);

Node.js

const crypto = require('crypto');
app.post('/hook', express.raw({type:'application/json'}), (req,res)=>{
  const sig = crypto.createHmac('sha256', process.env.ZAPAY_API_KEY).update(req.body).digest('hex');
  const ok = crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(req.get('X-Zapay-Signature')||''));
  if(!ok) return res.sendStatus(403);
  const d = JSON.parse(req.body); /* proses d.event */ res.sendStatus(200);
});

Notifikasi Midtrans ke Zapay: set Payment Notification URL di dashboard Midtrans ke https://zapay.zannmods.net/webhook/midtrans

Popup pembayaran (Snap Zapay)

Setelah createtransaksi di server, kirim pay_url ke frontend lalu buka popup. Callback menerima settlement, expire, cancel, atau deny. Pembeli yang membuka pay_url langsung di tab akan diarahkan ke callback URL project setelah lunas.

<script src="https://zapay.zannmods.net/zapay.js"></script>
<script>
  // pay_url didapat dari server Anda (hasil /api/v1/createtransaksi)
  Zapay.pay(payUrl, function(status){ if(status==='settlement'){ location.reload(); } });
</script>

Kode error