Quick start

1. Get your credentials

Your LintasPay account manager gives you:

Item	What it is
`app_id`	64-character lowercase hex, derived from your upstream binding. It goes in every request's `Authorization` header. Your account manager gives you this value. Do not send the upstream id.
`merchantId`	Your merchant number. It appears in responses and callbacks.
Your key pair	You generate an RSA-2048 key pair and send us only the public key. Keep the private key secret.
LintasPay public key	Used to verify our responses and callbacks. You can also download it.

Generate your key pair with OpenSSL. PKCS8 is required for the Java sample and for in-browser signing in Swagger:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out merchant_private_key.pem
openssl pkey -in merchant_private_key.pem -pubout -out merchant_public_key.pem

Send merchant_public_key.pem to LintasPay. That is the only key material you register. The public key is stored with client create --pubkey or client set-pubkey. Swagger does not upload keys: the Sign requests panel signs in your browser, and the private key never leaves the page.

The app_id you send is not the upstream application id. Your account manager gives you the downstream value derived from your upstream binding.

For production, tell us the server IPs you will call from, so we can restrict your account to them.

2. Make your first call

The bank list call has no side effects, so it's a good first test:

APP_ID=your_app_id
URL_PATH=/data/bank-list
BODY='{"type":1}'
AUTH="app_id=$APP_ID,nonce=$(openssl rand -hex 16),timestamp=$(date +%s)000"
SIGN=$(printf '%s\nPOST\n%s\n%s\n' "$AUTH" "$URL_PATH" "$BODY" \
  | openssl dgst -sha256 -sign merchant_private_key.pem | base64 | tr -d '\n')

curl -sS -X POST "https://test.lintaspay.xyz$URL_PATH" \
  -H 'Content-Type: application/json' \
  -H "Authorization: LINTASPAY-SHA256withRSA $AUTH,sign=$SIGN" \
  -H "lintaspay-request-id: $(openssl rand -hex 16)" \
  -d "$BODY"

A response with "code":0 means your signing works. Full helpers for Node.js, Python, PHP and Java are on Signing requests.

3. Collect a payment

Call Create pay-in order with productCode 11 (BNI VA) and amount "10000".
Show the returned payCode (VA number) to your customer.
When the customer pays, LintasPay posts a pay-in notification to your notifyUrl. Reply {"status":"SUCCESS"}.
If you haven't received it, call Query pay-in order.

4. Send a payout

Get a bankId from Bank list. Optionally, check the account with Verify bank account.
Call Create payout.
Wait for the payout notification, or poll Query payout, until orderStatus is 4 (success) or 5 (failed).
Read the payout final-state rule before you go live.

5. Go live

When the sandbox flow works end to end, switch the base URL to production and use your production app_id and keys. Production accounts are separate. See Environments.