QRISPAY API Reference

curl -X POST https://qris.commitflow.space/api/payment/qris/generate \
  -H "X-API-Token: YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "amount": 50000,
  "payment_reference": "Order-123",
  "return_url": "https://yoursite.com/thanks"
}'

{
  "status": "success",
  "data": {
    "qris_id": "abc-123",
    "amount": 50000,
    "qris_image_url": "https://qris.commitflow.space/api/public/qris/abc-123/image",
    "expires_in_seconds": 900
  }
}

const API_TOKEN = 'YOUR_API_TOKEN';
const BASE_URL = 'https://qris.commitflow.space';

async function generateQRIS(amount, ref, returnUrl) {
  const res = await fetch(`${BASE_URL}/api/payment/qris/generate`, {
    method: 'POST',
    headers: { 'X-API-Token': API_TOKEN, 'Content-Type': 'application/json' },
    body: JSON.stringify({ amount, payment_reference: ref, return_url: returnUrl })
  });
  return res.json();
}

async function checkStatus(qrisId) {
  const res = await fetch(`${BASE_URL}/api/payment/qris/${qrisId}/status`, {
    headers: { 'X-API-Token': API_TOKEN }
  });
  return res.json();
}

async function cancelQRIS(qrisId) {
  const res = await fetch(`${BASE_URL}/api/payment/qris/${qrisId}/cancel`, {
    method: 'POST', headers: { 'X-API-Token': API_TOKEN }
  });
  return res.json();
}

<?php
define('API_TOKEN', 'YOUR_API_TOKEN');
define('API_URL', 'https://qris.commitflow.space');

function generateQRIS($amount, $ref = null, $returnUrl = null) {
  $data = ['amount' => $amount];
  if ($ref) $data['payment_reference'] = $ref;
  if ($returnUrl) $data['return_url'] = $returnUrl;

  $ch = curl_init(API_URL . '/api/payment/qris/generate');
  curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($data),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
      'Content-Type: application/json',
      'X-API-Token: ' . API_TOKEN
    ],
  ]);
  $response = curl_exec($ch);
  curl_close($ch);
  return json_decode($response, true);
}

import requests

API_TOKEN = 'YOUR_API_TOKEN'
BASE_URL = 'https://qris.commitflow.space'
HEADERS = {'X-API-Token': API_TOKEN, 'Content-Type': 'application/json'}

def generate_qris(amount, ref=None, return_url=None):
    data = {'amount': amount}
    if ref: data['payment_reference'] = ref
    if return_url: data['return_url'] = return_url
    res = requests.post(f'{BASE_URL}/api/payment/qris/generate', json=data, headers=HEADERS)
    return res.json()

def check_status(qris_id):
    res = requests.get(f'{BASE_URL}/api/payment/qris/{qris_id}/status', headers=HEADERS)
    return res.json()

result = generate_qris(50000, 'Order-123', 'https://yoursite.com/thanks')
print(result['data']['qris_image_url'])

{
  "event": "qris.paid",
  "qris_id": "abc-123",
  "amount": 50000,
  "status": "paid",
  "paid_at": "2026-01-11T20:15:00.000Z",
  "matched_via": "mobile_notification",
  "app_package": "com.dana"
}

X-Qrispay-Signature: t=1672531199,v1=f6a9c7b8d8...

const crypto = require('crypto');

app.post('/webhook/callback', (req, res) => {
  const sig = req.headers['x-qrispay-signature'];
  const SECRET = 'YOUR_WEBHOOK_SECRET'; // whsec_...

  const [tPart, vPart] = sig.split(',');
  const timestamp = tPart.split('=')[1];
  const received  = vPart.split('=')[1];

  // Reject if older than 5 minutes
  if (Math.abs(Date.now()/1000 - parseInt(timestamp)) > 300)
    return res.status(400).send('Request expired');

  const computed = crypto
    .createHmac('sha256', SECRET)
    .update(`${timestamp}.${JSON.stringify(req.body)}`)
    .digest('hex');

  if (computed === received) {
    res.json({ received: true });
  } else {
    res.status(401).send('Invalid signature');
  }
});