Skip to main content
All REST API endpoints require authentication before you can call them. Webhook callbacks use a separate HMAC signature scheme.

​
Obtain an access token

Request a JWT access token using your Client ID and Client Secret from the merchant dashboard. Request a token using POST /api/v1.1/access-token/b2b, listed under Security in the API reference sidebar (OpenAPI-generated endpoint page).
You can also use POST /api/v1.0/access-token/b2b on older integrations.

​
Token request headers

​
Token request body

The response includes a Bearer token and expiry time. Request a new token before the current one expires.

​
Authenticated API requests

Include these headers on every REST API call after you obtain a token:

​
Signed requests (selected endpoints)

Some money-out operations require additional headers for request signing: Endpoints that typically require signing include:
  • Disbursement transfer (POST /api/v2.0/disbursement/transfer)
  • QRIS issuer payment credit and related money-out flows
  • E-Wallet trigger top-up (POST /api/v2.0/ewallet/trigger-topup)
Refer to the OpenAPI reference for each endpoint to confirm required headers. See Building the X-Signature Header for the full signing formula, required headers, and code examples in PHP, Node.js, and Python.

​
IP whitelist

Merchant API routes may require your server IP to be registered on the merchant account before requests are accepted. Configure allowed IPs in the merchant dashboard before going to production.
IP Whitelist Required — Ensure your server IP is registered for the merchant account before making API requests from production systems.

​
Environments

Use Sandbox for development and testing. No real money moves in Sandbox.