1. Auth & Sign

Setiap request wajib kirim merchant_id + sign. Buat sign dari semua field sign (tanpa sign itu sendiri), urut A-Z, gabung k=v dengan &, tambah &key=API_SECRET, MD5 uppercase.

PHP:
$sign = strtoupper(md5("amount=50000&channel=QRIS&merchant_id=MCH001¬ify_url=https://...&order_id=INV-001&key=s3cr3t"));

JS:
const crypto=require('crypto');
function sign(p,s){const k=Object.keys(p).sort().map(k=>k+'='+p[k]).join('&')+'&key='+s;return crypto.createHash('md5').update(k).digest('hex').toUpperCase();}

Python:
import hashlib
def sign(p,s):
    q='&'.join(f"{k}={p[k]}" for k in sorted(p)) + f"&key={s}"
    return hashlib.md5(q.encode()).hexdigest().upper()

2. Create Payin — POST /api/v1/payin_create.php

{
  "merchant_id":"MCH001","order_id":"INV-001","amount":50000,"channel":"QRIS",
  "notify_url":"https://merchant.com/lottopay_notify",
  "return_url":"https://merchant.com/thanks",
  "customer_name":"Budi","customer_email":"[email protected]","customer_phone":"0812xxxx",
  "attach":"userid=123","sign":"..."
}
Response:
{"code":0,"msg":"success","data":{"trx_id":"LP...","order_id":"INV-001","amount":50000,"fee":1000,"channel":"QRIS","status":"PENDING","payment_link":"https://...","va_number":"","qr_string":"..."}}

Channel: QRIS, BCA, BRI, MANDIRI, BNI, PERMATA, CIMB, DANAMON, BSI, OCBC, DANA, OVO, GOPAY, SHOPEEPAY, LINKAJA. Lihat channels JSON. order_id unik per merchant (idempotent).

3. Query Payin — POST /api/v1/payin_query.php

{"merchant_id":"MCH001","order_id":"INV-001","sign":"..."}
# atau pakai trx_id: {"merchant_id":"MCH001","trx_id":"LP...","sign":"..."}
Status: CREATED, PENDING, PAID, FAILED

4. Callback ke Merchant (server-to-server)

LottoPay POST JSON ke notify_url saat status final. Balas HTTP 200 + SUCCESS.

{
 "merchant_id":"MCH001","order_id":"INV-001","trx_id":"LP...",
 "amount":"50000","paid_amount":"50000","status":"PAID",
 "sign":"UPPER(MD5(amount=..&merchant_id=..&order_id=..&paid_amount=..&status=..&trx_id=..&key=SECRET))"
}

5. Payout — POST /api/v1/payout_create.php

{"merchant_id":"MCH001","order_id":"WD-001","amount":100000,"bank_code":"BCA","account_no":"1234567890","account_name":"BUDI","notify_url":"https://...","sign":"..."}
Query: POST /api/v1/payout_query.php {"merchant_id":"MCH001","order_id":"WD-001","sign":"..."}
Balance: GET /api/v1/balance.php?merchant_id=MCH001&sign=...

Fee payout default Rp5.000. Saldo terpotong saat create, refund otomatis jika FAILED.

6. Error code

0 sukses | 400 param salah | 401 sign/merchant salah | 402 saldo kurang | 404 order tidak ada | 409 duplicate | 500 server error