Payment Method: GoPay Tokenization (Pre Auth)

📘

Merchant can now test CoreAPI BI-SNAP flow on Sandbox!

For more details, go here.

This new sandbox will be rolled out to all merchant from October 22nd, 2024. Please contact your sales representative for early access.


📘

GoPay Media Kit

To have a consistent and standardized GoPay branding across platform, we highly recommend merchants to refer to our media kit. Please refer to this page https://gopay.co.id/media-kit to access our brand guideline and image bank.

This section will explain how merchant can initiate GoPay Tokenization (Pre-Auth) transactions using SNAP-based CoreAPI specification.

  1. In order to do GoPay Tokenization transaction, merchant should link the customer's GoPay account first by initiating the Account Linking API.
  2. Once linked, merchant can reserve user's balance by initiating auth payment (auth API)
  3. To actually deduct user's balance merchant will need to capture the authorized transaction (capture API)
  4. If merchant wants to release user's balance without actually deduct the balance, merchant will need to void the transaction by calling Void API. Authorized transaction that is not captured after its expiry time will be auto canceled.
  5. Merchant can also do other subsequent actions such as Refund, and Get Status.
📘

Currently GoPay Tokenization pre-auth only supports No PIN transaction. Please contact your Midtrans sales representative to enable pre-auth transaction.

📘

GoPay Tokenization in BI-SNAP flow can also support both GoPay & GoPay Later payment. Merchant should pass the corresponding payment option token as payOptionDetails.additionalInfo.paymentoptiontoken in the request body. The payment option token can be retrieved from Binding Inquiry API.

Creating GoPay Tokenization Pre-Auth transaction

Reserving user's balance - Auth Payment API

This section describes how merchants can reserve user's balance without actually deducting it from the start by calling Auth Payment API.

Path/{version}/auth/payment
HTTP MethodPOST
Versionv1.0
SNAP service code63

Request Header

Field NameField TypeMandatoryField Description
Content-typeStringMMedia type of the resource, i.e. application/json
X-TIMESTAMPStringMClient’s current local time in ISO-8601 format
X-SIGNATUREStringMCreated using symmetric signature HMAC_SHA512 algorithm
AuthorizationStringMRepresents access_token of a request; string starts with keyword “Bearer ” followed by access_token. Can get this token from Access Token B2B API response.
Authorization-CustomerStringMaccessToken which Gopay will be sharing once linking is complete. string starts with keyword “Bearer ”followed by access_token.
X-PARTNER-IDStringMUnique identifier for caller
X-EXTERNAL-IDStringMAlphanumeric string. We suggest merchant to use UUID format. The value should be unique.
In case of timeout, merchant can do:
  1. Use this value in get status API to get status transaction or
  2. Retry this request with the same X-EXTERNAL-ID and request body to avoid creating duplicate transaction
CHANNEL-IDStringMMandatory field from Bank Indonesia that can take any value with correct format 5 digits numeric string
X-DEVICE-IDStringMDevice identification on which the API services are currently being accessed by the end user (customer).Sample:
Web Application:
Mozilla / 5.0(Windows NT 10.0; Win64; x64)AppleWebKit / 537.36(KHTML, like Gecko)Chrome / 75.0.3770.100 Safari / 537.36 OPR / 62.0.3331.99Mobile Application:
Android: android-20013adf6cdd8123f
iOS: 72635bdfd223yvjm7246nsdj34hd4559393kjh42
Content-type:application/json
X-TIMESTAMP:2024-03-19T14:30:00+07:00
X-SIGNATURE: da1fa417c72d6b91c257e01e54fac824
Authorization: Bearer gp9HjjEj813Y9JGoqwOeOPWbnt4CupvIJbU1Mmu4a11MNDZ7Sg5u9a
Authorization-Customer: Bearer gp9HjjEj813Y9JGoqwOeOPWbnt4CupvIJbU1Mmu4a11MNDZ7Sg5u9a
X-PARTNER-ID: BMRI
X-DEVICE-ID: 0987ADCASA
X-EXTERNAL-ID:12345678901234567890
CHANNEL-ID:12345

Request Body

Field NameField TypeMandatoryField Description
partnerReferenceNoString (64)MMerchant order-id.
Note: Allowed Symbols are dash(-), underscore(_), tilde (~), and dot (.). Any request containing unauthorized symbols will be automatically declined.

Only used for debugging purposes on the server side.

merchantIdString(64)MMerchant’s unique ID provided by Midtrans.
amountObjectOTransaction amount
amount.valueString (ISO4217)MNet amount of the transaction. If it's IDR then value includes 2 decimal digits. e.g. IDR 10.000,- will be placed with 10000.00
amount.currencyString(3)MCurrency
titleString(256)MOrder title
itemsArray of ObjectOItem details
items.idString(32)OItem ID
items.priceObjectMPrice of the item
items.price.valueString (ISO4217)MItem price value
items.price.currencyStringMItem price currency
items.quantityString(16)MItem quantity
items.nameString(64)MItem name
items.brandString(64)OBrand name of the item
items.categoryString(64)OCategory of the item
items.merchantNameString(64)OName of the merchant selling the item.
additionalInfoObjectMAdditional Information
additionalInfo.merchantCrossReferenceIdString (64)CMerchant cross reference id (payment flow identifier). Will be mandatory for Midtrans merchants with custom integration. Midtrans team will let you know when you need to pass this indentifier.
additionalInfo.payOptionDetails.payOptionString (64)CPayment option which shows the provider of this payment. This parameter is mandatory unless merchants have custom integration with Midtrans. Midtrans team will let you know if this parameter is optional in the case of custom integration.

Possible value: GOPAY_WALLET, GOPAY_WALLET_POCKET

additionalInfo.payOptionDetails.payMethodString (64)MPossible value: GOPAY
additionalInfo.payOptionDetails.transAmountObjectMPayment transaction amount
additionalInfo.payOptionDetails.transAmount.valueString (16,2)MTransaction amount that will be paid using this payment method If it's IDR then value includes 2 decimal digits.

e.g. IDR 10.000,- will be placed with 10000.00

additionalInfo.payOptionDetails.transAmount.currencyString (3)MIDR
additionalInfo.payOptionDetails.additionalInfo.paymentOptionTokenStringCPayment option token . This parameter is mandatory unless merchants have custom integration with Midtrans. Midtrans team will let you know if this parameter is optional in the case of custom integration.
additionalInfo.customerDetailsObjectOCustomer detail information
additionalInfo.customerDetails.phoneString(15)OCustomer phone number
additionalInfo.customerDetails.emailString(255)OCustomer email
additionalInfo.customerDetails.firstNameString(255)OCustomer first name
additionalInfo.customerDetails.lastNameString(255)OCustomer last name
additionalInfo.customerDetails.billingAddressObjectOBilling address information
additionalInfo.customerDetails.billingAddress.firstNameString(255)OBilling address first name
additionalInfo.customerDetails.billingAddress.lastNameString(255)OBilling address last name
additionalInfo.customerDetails.billingAddress.phoneString(15)OBilling address phone number
additionalInfo.customerDetails.billingAddress.addressString(255)OBilling address detail
additionalInfo.customerDetails.billingAddress.cityString(255)OBilling address city
additionalInfo.customerDetails.billingAddress.postalCodeString(255)OBilling address postal code
additionalInfo.customerDetails.billingAddress.countryCodeString(15)OBilling address country code
additionalInfo.customerDetails.shippingAddressObjectOShipping address information
additionalInfo.customerDetails.shippingAddress.firstNameString(255)OShipping address first name
additionalInfo.customerDetails.shippingAddress.lastNameString(255)OShipping address last name
additionalInfo.customerDetails.shippingAddress.phoneString(15)OShipping address phone number
additionalInfo.customerDetails.shippingAddress.addressString(255)OShipping address detail
additionalInfo.customerDetails.shippingAddress.cityString(255)OShipping address city
additionalInfo.customerDetails.shippingAddress.postalCodeString(255)OShipping address postal code
additionalInfo.customerDetails.shippingAddress.countryCodeString(15)OShipping address country code
additionalInfo.validUpToString(25)OThe time when the payment will be automatically expired. Using ISO 8601 format

(Maximum value: 180 days from trx time, Minimum value: 20 second, default value: 7 days)

{
    "partnerReferenceNo": "merchant-order-id",
    "merchantId": “aMerchantId",
    "amount": {
                "value": "12345678.00",
                "currency": "IDR"
            },
     "items": [
                  {
                          "id": "8za1ieleavwusxn6u5re60ri",
                          "price":  {
                                "value": "12345678.00",
                                "currency": "IDR"
                            },
                          "quantity": “1”,
                          "name": "subscription ",
                          "brand": "brand ",
                          "category": "Subsciption ",
                          "url": "www.google.com ",
                          "merchantName": "amazon prime"
                  }
                 ],
    "additionalInfo": {
    		  "merchantCrossReferenceId": "303b4f89-xxxx-xxxx-xxxx-62a8ffaefaf3",
          "payOptionDetails": [
         {
            "payMethod": "GOPAY",
            "payOption": "GOPAY_WALLET",
            "transAmount": {
                "value": "12345678.00",
                "currency": "IDR"
            },
            "additionalInfo": {
                    "paymentOptionToken": "aGoPayWalletToken / aPayLaterToken"
                }
        }
    ],
          "customerDetail": {
                "phone": "81234532422",
                "firstName": "farz",
                "lastName": "zsasa",
                "email": "[email protected]",
                "billingAddress": {
                        "firstName": "billingFirstName",
                        "lastName": "billingLastName",
                        "phone": "billingPhone",
                        "address": "billingAddress",
                        "city": "billingCity",
                        "postalCode": "12790",
                        "countryCode": "CZH"
                 },
                "shippingAddress": {
                        "firstName": "shippingFirstName",
                        "lastName": "shippingLastName",
                        "phone": "shippingPhone",
                        "address": "shippingAddress",
                        "city": "shippingCity",
                        "postalCode": "12790",
                        "countryCode": "CZH"
                 
                 },
            }
        
    }
}

Response Header

Field NameField TypeMandatoryField Description
Content-typeStringMMedia type of the resource, i.e. application/json
X-TIMESTAMPStringMClient’s current local time in ISO-8601 format
Content-type: application/json
X-TIMESTAMP: 2024-03-19T14:30:00+07:00

Response Body

Field NameField TypeMandatoryField Description
responseCodeString (7)MError code to specify the error returned.
responseMessageString (150)MDebug message to provide more information.
referenceNoString (256)OUnique transaction identifier from payment provider system e.g : Gopay order ID.
partnerReferenceNoString (32)OUnique transaction identifier from Merchant (Merchant order ID).
paidTimeString (25)MTransaction paid time. ISO 8601 YYYY-MM-DDThh:mm:ss
additionalInfoObjectOAdditional information
additionalInfo.amountObjectOTransaction Total Amount Object
additionalInfo.amount.valueStringMNet amount of the refund. If it's IDR then the value includes 2 decimal digits.

e.g. IDR 10.000,- will be placed with 10000.00

additionalInfo.amount.currencyStringMCurrency
additionalInfo.transactionTimeStringOTimestamp of transaction in ISO 8601 format. Time zone: GMT+7.
additionalInfo.transactionStatusStringOStatus of GoPay transaction.Possible Values:
  • 00 - Success
  • 01 - Authorize
  • 04 - Refunded
  • 05 - Canceled
  • 06 - Failed
additionalInfo.fraudStatusStringOFraud status
additionalInfo.payOptionDetailsArray of ObjectMPayment option detail
additionalInfo.payOptionDetails.payMethodStringMGopay
additionalInfo.payOptionDetails.payOptionsStringMGopay payment option used
additionalInfo.validUpToString(25)OThe time when the payment will be automatically expired. Using ISO 8601 format
{
   "responseCode":"20054000",
   "responseMessage":"Request has been processed successfully",
   "referenceNo":"Gopay-order-id",
   "partnerReferenceNo":"merchant-order-id",
   "paidTime":"2009-07-03T12:08:56+07:00",
   "additionalInfo":{
      "grossAmount":"10000.00",
      "currency":"IDR" 
      "paymentType":"Gopay",
      "transactionTime":"2024-05-22T07:48:08.56Z",
      "transactionStatus":"settlement"  
      "fraudStatus":"some-fraud-status"  ,
       “payOptionDetails” : [{
            "payMethod":"GOPAY",
            "payOption": "GOPAY_WALLET"
        }], 
     "validUpTo":"2024-05-22T16:00:00.00Z"

   }
}
{
   "responseCode":"4006301",
   "responseMessage":"There is some issue with the transaction request"
}

List of Response code

Response CodeHTTP Status CodeResponse Message
2006300200Success
4006302400Invalid Mandatory Field {Field Name}
4016300401Unauthorized. Auth token required
4016301401Invalid Token (B2B)
4016302401Invalid Customer Token
4031003403Suspected Fraud
4031014403Insufficient Funds
5006301500Internal Server Error
5046300504Timeout

Capturing user's balance - Capture API

This section describes how merchants can capture a transaction that has been reserved/authorized and deduct user balance by calling Capture API.

Path/{version}/auth/capture
HTTP MethodPOST
Versionv1.0
SNAP service code65

Request Header

Field NameField TypeMandatoryField Description
Content-typeStringMMedia type of the resource, i.e. application/json
X-TIMESTAMPStringMClient’s current local time in ISO-8601 format
X-SIGNATUREStringMCreated using symmetric signature HMAC_SHA512 algorithm
AuthorizationStringMRepresents access_token of a request; string starts with keyword “Bearer ” followed by access_token. Can get this token fromAccess Token B2B API response.
X-PARTNER-IDStringMUnique identifier for caller (client_id)
X-EXTERNAL-IDStringMAlphanumeric string. We suggest merchant to use UUID format. The value should be unique.
In case of timeout, merchant can do:
  1. Use this value in get status API to get status transaction or
  2. Retry this request with the same X-EXTERNAL-ID and request body to avoid creating duplicate transaction
CHANNEL-IDStringMMandatory field from Bank Indonesia that can take any value with correct format 5 digits numeric string
Content-type:application/json
X-TIMESTAMP:2024-03-19T14:30:00+07:00
X-SIGNATURE: da1fa417c72d6b91c257e01e54fac824
Authorization: Bearer gp9HjjEj813Y9JGoqwOeOPWbnt4CupvIJbU1Mmu4a11MNDZ7Sg5u9a
X-PARTNER-ID: BMRI
X-EXTERNAL-ID:12345678901234567890
CHANNEL-ID:12345

Request Body

originalReferenceNoString(64)CTransaction identifier on service provider system. For e.g: GopayOrderId

Note: either additionalInfo.originalExternalId or OriginalReferenceNo need to be filled

If both fields have value, will use originalReferenceNo as the main identifier.

originalPartnerReferenceNoString (64)MMerchant order id
merchantIdString(64)MMerchant’s unique ID provided by Midtrans.
partnerCaptureNoString (64)MCapture identifier generated by the partner
captureAmountStringOTransaction amount that merchant wants to capture. Currently only full capture is supported.
captureAmount.valueStringMCapture amount value
captureAmount.currencyStringMCapture amount currency
titleString(256)MOrder title
additionalInfo
additionalInfo.originalExternalIdString (36)CIf merchant got a timeout from the auth endpoint, merchant can use this field using the X-EXTERNAL-ID value in the direct debit request header.

Note: either originalExternalId or OriginalReferenceNo need to be filled

{
    "originalReferenceNo": "2020102900000000000001",
    "originalPartnerReferenceNo": "123123123123",
    "partnerCaptureNo": "asdv-asdasdv-addasd-1231ewqqw-aaaa",
    "merchantId": "merch00001",
    "captureAmount": {
        "value": "12345678.00",
        "currency": "IDR"
    },
    "title": "aTitle",
    "additionalData": {
        "originalExternalId": "aId"
    }
}

Response Header

Field NameField TypeMandatoryField Description
Content-typeStringMMedia type of the resource, i.e. application/json
X-TIMESTAMPStringMClient’s current local time in ISO-8601 format
Content-type: application/json
X-TIMESTAMP: 2024-03-19T14:30:00+07:00

Response Body

Field NameField TypeMandatoryField Description
responseCodeString (7)MError code to specify the error returned.
responseMessageString (150)MDebug message to provide more information.
originalReferenceNoString (256)OTransaction identifier on service provider system. For e.g: GopayOrderId
originalPartnerReferenceNoString (32)OTransaction identifier on service consumer system
captureNoString (64)CPJSP's capture identifier. Used to trace the capture when there's any issue occurred.
partnerCaptureNoString (64)OCapture identifier generated by the partner
captureAmount
captureAmount.valueString (16,2)OTransaction amount that will be paid using this payment method If it's IDR then value includes 2 decimal digits.

e.g. IDR 10.000,- will be placed with 10000.00

captureAmount.currencyStringOCurrency For e.g: IDR
captureTimeString(25)CCapture time. Format capture time: (ISO 8601) YYYY-MM-DDThh:mm:ss. Must be filled upon successful transaction
{
   "responseCode":"20054000",
   "responseMessage":"Successful",
    "originalReferenceNo":"2020102900000000000001",
   "originalPartnerReferenceNo":"123123123123",
   "captureNo":"asdv-asdasdv-addasd-1231ewqqw-aaaa",
   "partnerCaptureNo":"asdv-asdasdv-addasd-1231ewqqw-aaaa",
   "captureAmount":{
  	"value":"12345678.00",
  	"currency":"IDR"
   },
   "captureTime": "2009-07-03T12:08:56+07:00"
}
{
   "responseCode":"4006501",
   "responseMessage":"There is some issue with the transaction request"
}

List of Response code

Response CodeHTTP Status CodeResponse Message
2006500200Successful
4006502400Invalid Mandatory Field {Field Name}
4016500401Unauthorized. Auth token required
4016501401Invalid Token (B2B)
4036515403Transaction Not Permitted.[reason].
5006501500Internal Server Error
5046500504Timeout

Additional APIs

  1. Refund API
  2. Cancel API
  3. Get Transaction Status API