Contoh kode

Kumpulan contoh siap salin untuk endpoint utama. Ganti YOUR_API_KEY dengan API key akses H2H Anda.

Base URL:

https://api.t4topup.id/v1/member-api

Profile

curl -sS "https://api.t4topup.id/v1/member-api/profile" \
  -H "x-api-key: YOUR_API_KEY"

const res = await fetch('https://api.t4topup.id/v1/member-api/profile', {
  headers: { 'x-api-key': process.env.H2H_API_KEY },
});

if (!res.ok) throw new Error(await res.text());
console.log(await res.json());

$ch = curl_init('https://api.t4topup.id/v1/member-api/profile');
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    'x-api-key: ' . getenv('H2H_API_KEY'),
  ],
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status . PHP_EOL . $response;

import os
import requests

response = requests.get(
    'https://api.t4topup.id/v1/member-api/profile',
    headers={'x-api-key': os.environ['H2H_API_KEY']},
    timeout=30,
)
response.raise_for_status()
print(response.json())

package main

import (
  "fmt"
  "io"
  "net/http"
  "os"
)

func main() {
  req, _ := http.NewRequest(http.MethodGet, "https://api.t4topup.id/v1/member-api/profile", nil)
  req.Header.Set("x-api-key", os.Getenv("H2H_API_KEY"))

  res, err := http.DefaultClient.Do(req)
  if err != nil {
    panic(err)
  }
  defer res.Body.Close()
  io.Copy(os.Stdout, res.Body)
  fmt.Println()
}

HttpRequest request = HttpRequest.newBuilder()
  .uri(URI.create("https://api.t4topup.id/v1/member-api/profile"))
  .header("x-api-key", System.getenv("H2H_API_KEY"))
  .GET()
  .build();

HttpResponse<String> response = HttpClient.newHttpClient()
  .send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.body());

Products

curl -sS "https://api.t4topup.id/v1/member-api/products?category_code=MLBB" \
  -H "x-api-key: YOUR_API_KEY"

const url = new URL('https://api.t4topup.id/v1/member-api/products');
url.searchParams.set('category_code', 'MLBB');

const res = await fetch(url, {
  headers: { 'x-api-key': process.env.H2H_API_KEY },
});
console.log(await res.json());

$url = 'https://api.t4topup.id/v1/member-api/products?category_code=MLBB';
$ch = curl_init($url);
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ['x-api-key: ' . getenv('H2H_API_KEY')],
]);
echo curl_exec($ch);

import os
import requests

response = requests.get(
    'https://api.t4topup.id/v1/member-api/products',
    params={'category_code': 'MLBB'},
    headers={'x-api-key': os.environ['H2H_API_KEY']},
    timeout=30,
)
print(response.json())

req, _ := http.NewRequest(
  http.MethodGet,
  "https://api.t4topup.id/v1/member-api/products?category_code=MLBB",
  nil,
)
req.Header.Set("x-api-key", os.Getenv("H2H_API_KEY"))
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
io.Copy(os.Stdout, res.Body)

Create order

curl -sS -X POST "https://api.t4topup.id/v1/member-api/orders" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "product_code": "MLBB_ID_5",
    "partner_ref": "ORDER-1001",
    "data": {
      "user_id": "348553128",
      "server_id": "943"
    }
  }'

async function createOrder() {
  const res = await fetch('https://api.t4topup.id/v1/member-api/orders', {
    method: 'POST',
    headers: {
      'x-api-key': process.env.H2H_API_KEY,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      product_code: 'MLBB_ID_5',
      partner_ref: 'ORDER-1001',
      data: {
        user_id: '348553128',
        server_id: '943',
      },
    }),
  });

  const data = await res.json();
  if (!res.ok) throw new Error(JSON.stringify(data));
  return data;
}

console.log(await createOrder());

$payload = json_encode([
  'product_code' => 'MLBB_ID_5',
  'partner_ref' => 'ORDER-1001',
  'data' => [
    'user_id' => '348553128',
    'server_id' => '943',
  ],
], JSON_UNESCAPED_SLASHES);

$ch = curl_init('https://api.t4topup.id/v1/member-api/orders');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    'x-api-key: ' . getenv('H2H_API_KEY'),
    'Content-Type: application/json',
  ],
  CURLOPT_POSTFIELDS => $payload,
]);

echo curl_exec($ch);

import os
import requests

response = requests.post(
    'https://api.t4topup.id/v1/member-api/orders',
    headers={
        'x-api-key': os.environ['H2H_API_KEY'],
        'Content-Type': 'application/json',
    },
    json={
        'product_code': 'MLBB_ID_5',
        'partner_ref': 'ORDER-1001',
        'data': {
            'user_id': '348553128',
            'server_id': '943',
        },
    },
    timeout=30,
)
print(response.status_code, response.json())

payload := []byte(`{
  "product_code": "MLBB_ID_5",
  "partner_ref": "ORDER-1001",
  "data": {"user_id": "348553128", "server_id": "943"}
}`)

req, _ := http.NewRequest(
  http.MethodPost,
  "https://api.t4topup.id/v1/member-api/orders",
  bytes.NewReader(payload),
)
req.Header.Set("x-api-key", os.Getenv("H2H_API_KEY"))
req.Header.Set("Content-Type", "application/json")

res, err := http.DefaultClient.Do(req)
if err != nil {
  panic(err)
}
defer res.Body.Close()
io.Copy(os.Stdout, res.Body)

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key", Environment.GetEnvironmentVariable("H2H_API_KEY"));

var payload = """
{
  "product_code": "MLBB_ID_5",
  "partner_ref": "ORDER-1001",
  "data": { "user_id": "348553128", "server_id": "943" }
}
""";

using var content = new StringContent(payload, Encoding.UTF8, "application/json");
var response = await client.PostAsync("https://api.t4topup.id/v1/member-api/orders", content);
Console.WriteLine(await response.Content.ReadAsStringAsync());

Check order status

curl -sS "https://api.t4topup.id/v1/member-api/orders/ORDER-1001" \
  -H "x-api-key: YOUR_API_KEY"

const ref = encodeURIComponent('ORDER-1001');
const res = await fetch(`https://api.t4topup.id/v1/member-api/orders/${ref}`, {
  headers: { 'x-api-key': process.env.H2H_API_KEY },
});
console.log(await res.json());

$ref = rawurlencode('ORDER-1001');
$ch = curl_init("https://api.t4topup.id/v1/member-api/orders/{$ref}");
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ['x-api-key: ' . getenv('H2H_API_KEY')],
]);
echo curl_exec($ch);

import os
from urllib.parse import quote
import requests

ref = quote('ORDER-1001', safe='')
response = requests.get(
    f'https://api.t4topup.id/v1/member-api/orders/{ref}',
    headers={'x-api-key': os.environ['H2H_API_KEY']},
    timeout=30,
)
print(response.json())

ref := url.PathEscape("ORDER-1001")
req, _ := http.NewRequest(
  http.MethodGet,
  "https://api.t4topup.id/v1/member-api/orders/"+ref,
  nil,
)
req.Header.Set("x-api-key", os.Getenv("H2H_API_KEY"))
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
io.Copy(os.Stdout, res.Body)

Verifikasi webhook (HMAC)

Saat menerima callback, verifikasi signature sebelum memproses event.

import crypto from 'node:crypto';

export function verifyWebhook({ apiSecret, timestamp, signature, rawBody }) {
  const expected = crypto
    .createHmac('sha256', apiSecret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  if (expected !== signature) {
    throw new Error('Invalid webhook signature');
  }
}

function verifyWebhook(string $apiSecret, string $timestamp, string $signature, string $rawBody): void {
  $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $apiSecret);
  if (!hash_equals($expected, $signature)) {
    throw new RuntimeException('Invalid webhook signature');
  }
}

import hashlib
import hmac

def verify_webhook(api_secret: str, timestamp: str, signature: str, raw_body: str) -> None:
    expected = hmac.new(
        api_secret.encode(),
        f'{timestamp}.{raw_body}'.encode(),
        hashlib.sha256,
    ).hexdigest()
    if not hmac.compare_digest(expected, signature):
        raise ValueError('Invalid webhook signature')

func verifyWebhook(apiSecret, timestamp, signature, rawBody string) error {
  mac := hmac.New(sha256.New, []byte(apiSecret))
  mac.Write([]byte(timestamp + "." + rawBody))
  expected := hex.EncodeToString(mac.Sum(nil))
  if !hmac.Equal([]byte(expected), []byte(signature)) {
    return errors.New("invalid webhook signature")
  }
  return nil
}

Tips praktis

Simpan API key di environment variable (H2H_API_KEY), jangan hardcode
Untuk retry order, kirim ulang partner_ref yang sama
Timeout jaringan ≠ gagal transaksi — cek status dengan GET /orders/:ref
Endpoint webhook harus membalas 2xx dengan cepat

Profile

Products

Create order

Check order status

Verifikasi webhook (HMAC)

Tips praktis

On this page