API Reference

https://api.cart.kirimlead.com

METHOD\nPATH_WITH_QUERY\nTIMESTAMP\nSHA256_HEX(BODY)

import { createHash, createHmac } from "node:crypto";

function sign(opts: {
  method: string;
  pathWithQuery: string;
  body: string;
  apiSecret: string;
}) {
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const bodyHash = createHash("sha256").update(opts.body).digest("hex");
  const signingString = [opts.method, opts.pathWithQuery, timestamp, bodyHash].join("\n");
  const signature = createHmac("sha256", opts.apiSecret)
    .update(signingString)
    .digest("hex");
  return { timestamp, signature };
}

<?php

function sign(string $method, string $pathWithQuery, string $body, string $apiSecret): array {
    $timestamp = (string) time();
    $bodyHash = hash("sha256", $body);
    $signingString = implode("\n", [$method, $pathWithQuery, $timestamp, $bodyHash]);
    $signature = hash_hmac("sha256", $signingString, $apiSecret);
    return ["timestamp" => $timestamp, "signature" => $signature];
}

import hashlib
import hmac
import time

def sign(method: str, path_with_query: str, body: str, api_secret: str) -> dict:
    timestamp = str(int(time.time()))
    body_hash = hashlib.sha256(body.encode()).hexdigest()
    signing_string = "\n".join([method, path_with_query, timestamp, body_hash])
    signature = hmac.new(api_secret.encode(), signing_string.encode(), hashlib.sha256).hexdigest()
    return {"timestamp": timestamp, "signature": signature}

package carthub

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"strconv"
	"strings"
	"time"
)

func Sign(method, pathWithQuery, body, apiSecret string) (timestamp, signature string) {
	timestamp = strconv.FormatInt(time.Now().Unix(), 10)
	sum := sha256.Sum256([]byte(body))
	bodyHash := hex.EncodeToString(sum[:])
	signingString := strings.Join([]string{method, pathWithQuery, timestamp, bodyHash}, "\n")
	mac := hmac.New(sha256.New, []byte(apiSecret))
	mac.Write([]byte(signingString))
	signature = hex.EncodeToString(mac.Sum(nil))
	return timestamp, signature
}

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid signature"
  }
}

import { createHash, createHmac } from "node:crypto";

const BASE = "https://api.cart.kirimlead.com";
const path = "/api/v1/invoices";
const body = JSON.stringify({
  externalId: "order-123",
  customerName: "Budi Santoso",
  customerEmail: "budi@example.com",
  itemName: "Pro Plan (1 tahun)",
  amountCents: 1_499_000,
  currency: "IDR",
  paymentChannel: "QRIS",
});

const { timestamp, signature } = sign({
  method: "POST",
  pathWithQuery: path,
  body,
  apiSecret: process.env.CARTHUB_SECRET!,
});

const res = await fetch(BASE + path, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-CartHub-Key": process.env.CARTHUB_KEY!,
    "X-CartHub-Timestamp": timestamp,
    "X-CartHub-Signature": signature,
    "Idempotency-Key": "order-123",
  },
  body,
});

const invoice = await res.json();
console.log(invoice.paymentUrl);

<?php
// assumes sign() from the Authentication section

$base = "https://api.cart.kirimlead.com";
$path = "/api/v1/invoices";
$body = json_encode([
    "externalId"     => "order-123",
    "customerName"   => "Budi Santoso",
    "customerEmail"  => "budi@example.com",
    "itemName"       => "Pro Plan (1 tahun)",
    "amountCents"    => 1499000,
    "currency"       => "IDR",
    "paymentChannel" => "QRIS",
]);

["timestamp" => $ts, "signature" => $sig] =
    sign("POST", $path, $body, getenv("CARTHUB_SECRET"));

$ch = curl_init($base . $path);
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $body,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        "Content-Type: application/json",
        "X-CartHub-Key: " . getenv("CARTHUB_KEY"),
        "X-CartHub-Timestamp: " . $ts,
        "X-CartHub-Signature: " . $sig,
        "Idempotency-Key: order-123",
    ],
]);
$invoice = json_decode(curl_exec($ch), true);
echo $invoice["paymentUrl"];

import os
import requests
# assumes sign() from the Authentication section

base = "https://api.cart.kirimlead.com"
path = "/api/v1/invoices"
body = json.dumps({
    "externalId": "order-123",
    "customerName": "Budi Santoso",
    "customerEmail": "budi@example.com",
    "itemName": "Pro Plan (1 tahun)",
    "amountCents": 1499000,
    "currency": "IDR",
    "paymentChannel": "QRIS",
})

sig = sign("POST", path, body, os.environ["CARTHUB_SECRET"])

res = requests.post(
    base + path,
    data=body,
    headers={
        "Content-Type": "application/json",
        "X-CartHub-Key": os.environ["CARTHUB_KEY"],
        "X-CartHub-Timestamp": sig["timestamp"],
        "X-CartHub-Signature": sig["signature"],
        "Idempotency-Key": "order-123",
    },
)
print(res.json()["paymentUrl"])

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	base := "https://api.cart.kirimlead.com"
	path := "/api/v1/invoices"
	body, _ := json.Marshal(map[string]any{
		"externalId":     "order-123",
		"customerName":   "Budi Santoso",
		"customerEmail":  "budi@example.com",
		"itemName":       "Pro Plan (1 tahun)",
		"amountCents":    1499000,
		"currency":       "IDR",
		"paymentChannel": "QRIS",
	})

	ts, sig := Sign("POST", path, string(body), os.Getenv("CARTHUB_SECRET"))

	req, _ := http.NewRequest("POST", base+path, bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-CartHub-Key", os.Getenv("CARTHUB_KEY"))
	req.Header.Set("X-CartHub-Timestamp", ts)
	req.Header.Set("X-CartHub-Signature", sig)
	req.Header.Set("Idempotency-Key", "order-123")

	res, _ := http.DefaultClient.Do(req)
	defer res.Body.Close()
	var invoice map[string]any
	json.NewDecoder(res.Body).Decode(&invoice)
	fmt.Println(invoice["paymentUrl"])
}

{
  "id": "9f1c...",
  "invoiceNumber": "INV-2026-0042",
  "appId": "app_...",
  "externalId": "order-123",
  "customerName": "Budi Santoso",
  "customerEmail": "budi@example.com",
  "customerPhone": "+628123456789",
  "itemName": "Pro Plan (1 tahun)",
  "amountCents": 1499000,
  "currency": "IDR",
  "items": [
    {
      "name": "Pro Plan",
      "description": null,
      "quantity": 1,
      "unitPriceCents": 1299000,
      "totalCents": 1299000
    }
  ],
  "status": "pending",
  "successUrl": null,
  "failedUrl": null,
  "expiredUrl": null,
  "metadata": null,
  "expiredAt": "2026-06-30T23:59:59Z",
  "paidAt": null,
  "cancelledAt": null,
  "createdAt": "2026-06-23T10:00:00Z",
  "updatedAt": "2026-06-23T10:00:00Z"
}

TS=$(date +%s)
PATH_Q="/api/v1/invoices/by-external/order-123"
EMPTY_SHA="e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
SIGNING_STRING=$(printf "GET\n%s\n%s\n%s" "$PATH_Q" "$TS" "$EMPTY_SHA")
SIG=$(printf "%s" "$SIGNING_STRING" \
  | openssl dgst -sha256 -hmac "$CARTHUB_SECRET" \
  | awk '{print $2}')

curl -s "https://api.cart.kirimlead.com$PATH_Q" \
  -H "X-CartHub-Key: $CARTHUB_KEY" \
  -H "X-CartHub-Timestamp: $TS" \
  -H "X-CartHub-Signature: $SIG"

{
  "id": "9f1c...",
  "invoiceNumber": "INV-2026-0042",
  "status": "cancelled",
  "cancelledAt": "2026-06-23T11:00:00Z"
}

{
  "channels": [
    {
      "code": "BRIVA",
      "name": "BRI Virtual Account",
      "group": "Virtual Account",
      "type": "virtual_account",
      "iconUrl": "https://.../briva.png",
      "feeMerchant": { "flat": 4250, "percent": 0 },
      "feeCustomer": { "flat": 0, "percent": 0 },
      "totalFee": { "flat": 4250, "percent": 0 },
      "minimum": 10000,
      "maximum": 50000000,
      "active": true
    },
    {
      "code": "QRIS2",
      "name": "QRIS by ShopeePay",
      "group": "E-Wallet",
      "type": "e_wallet",
      "iconUrl": "https://.../qris.png",
      "feeMerchant": { "flat": 0, "percent": 0 },
      "feeCustomer": { "flat": 0, "percent": 0.7 },
      "totalFee": { "flat": 0, "percent": 0.7 },
      "minimum": 1000,
      "maximum": 10000000,
      "active": true
    }
  ]
}

{
  "invoiceId": "9f1c...",
  "invoiceNumber": "INV-2026-0042",
  "customerName": "Budi Santoso",
  "customerEmail": "budi@example.com",
  "itemName": "Pro Plan (1 tahun)",
  "amountCents": 1499000,
  "currency": "IDR",
  "status": "pending",
  "items": [
    { "name": "Pro Plan", "quantity": 1, "unitPriceCents": 1299000, "totalCents": 1299000 }
  ],
  "paymentUrl": "https://tripay.co.id/checkout/T0000...",
  "expiredAt": "2026-06-30T23:59:59Z",
  "paidAt": null,
  "manualTransferEnabled": true,
  "successUrl": "https://app.example.com/thanks"
}

{
  "id": "wh_01J...",
  "eventType": "payment.paid",
  "timestamp": "2026-06-23T10:05:12.000Z",
  "data": {
    "invoiceId": "9f1c...",
    "invoiceNumber": "INV-2026-0042",
    "externalId": "order-123",
    "paymentStatus": "paid",
    "amountCents": 1499000,
    "currency": "IDR",
    "providerReference": "T0000...",
    "paidAt": "2026-06-23T10:05:11.000Z"
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyWebhook(opts: {
  rawBody: string;            // exact bytes CartHub sent
  timestamp: string;          // X-Webhook-Timestamp header
  signature: string;          // X-Webhook-Signature header
  webhookSecret: string;
  replayWindowSeconds?: number;
}): boolean {
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - Number(opts.timestamp)) > (opts.replayWindowSeconds ?? 300)) {
    return false;
  }
  const expected = createHmac("sha256", opts.webhookSecret)
    .update(`${opts.timestamp}.${opts.rawBody}`)
    .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(opts.signature);
  return a.length === b.length && timingSafeEqual(a, b);
}

<?php

function verify_webhook(
    string $rawBody,      // exact bytes CartHub sent
    string $timestamp,    // X-Webhook-Timestamp header
    string $signature,    // X-Webhook-Signature header
    string $webhookSecret,
    int $replayWindowSeconds = 300
): bool {
    if (abs(time() - (int) $timestamp) > $replayWindowSeconds) {
        return false;
    }
    $expected = hash_hmac("sha256", $timestamp . "." . $rawBody, $webhookSecret);
    return hash_equals($expected, $signature);
}

import hashlib
import hmac
import time

def verify_webhook(
    raw_body: str,        # exact bytes CartHub sent
    timestamp: str,       # X-Webhook-Timestamp header
    signature: str,       # X-Webhook-Signature header
    webhook_secret: str,
    replay_window_seconds: int = 300,
) -> bool:
    if abs(int(time.time()) - int(timestamp)) > replay_window_seconds:
        return False
    expected = hmac.new(
        webhook_secret.encode(), f"{timestamp}.{raw_body}".encode(), hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

package carthub

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"strconv"
	"time"
)

// rawBody is the exact bytes CartHub sent; timestamp/signature are the
// X-Webhook-Timestamp / X-Webhook-Signature headers.
func VerifyWebhook(rawBody, timestamp, signature, webhookSecret string, replayWindowSeconds int64) bool {
	ts, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil {
		return false
	}
	if now := time.Now().Unix(); now-ts > replayWindowSeconds || ts-now > replayWindowSeconds {
		return false
	}
	mac := hmac.New(sha256.New, []byte(webhookSecret))
	mac.Write([]byte(timestamp + "." + rawBody))
	expected := hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(expected), []byte(signature))
}