Verify OTP

Verify OTP

curl --request POST \
  --url https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-PARTNER-ID: <api-key>' \
  --data '
{
  "otp": "123456",
  "transaction_id": "01HZX9JK4M5N6P7Q8R9STUVWXY",
  "binding_id": "01HZX9JK4M5N6P7Q8R9STUVWXY",
  "unbind_context": {
    "partner_reference_no": "partner-ref-123456",
    "otp_token": "otp-token-abc123def456",
    "flow": "UNBINDING",
    "reference_no": "gw-ref-789012"
  }
}
'

import requests

url = "https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp"

payload = {
    "otp": "123456",
    "transaction_id": "01HZX9JK4M5N6P7Q8R9STUVWXY",
    "binding_id": "01HZX9JK4M5N6P7Q8R9STUVWXY",
    "unbind_context": {
        "partner_reference_no": "partner-ref-123456",
        "otp_token": "otp-token-abc123def456",
        "flow": "UNBINDING",
        "reference_no": "gw-ref-789012"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "X-PARTNER-ID": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-PARTNER-ID': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    otp: '123456',
    transaction_id: '01HZX9JK4M5N6P7Q8R9STUVWXY',
    binding_id: '01HZX9JK4M5N6P7Q8R9STUVWXY',
    unbind_context: {
      partner_reference_no: 'partner-ref-123456',
      otp_token: 'otp-token-abc123def456',
      flow: 'UNBINDING',
      reference_no: 'gw-ref-789012'
    }
  })
};

fetch('https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'otp' => '123456',
    'transaction_id' => '01HZX9JK4M5N6P7Q8R9STUVWXY',
    'binding_id' => '01HZX9JK4M5N6P7Q8R9STUVWXY',
    'unbind_context' => [
        'partner_reference_no' => 'partner-ref-123456',
        'otp_token' => 'otp-token-abc123def456',
        'flow' => 'UNBINDING',
        'reference_no' => 'gw-ref-789012'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-PARTNER-ID: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp"

	payload := strings.NewReader("{\n  \"otp\": \"123456\",\n  \"transaction_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"binding_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"unbind_context\": {\n    \"partner_reference_no\": \"partner-ref-123456\",\n    \"otp_token\": \"otp-token-abc123def456\",\n    \"flow\": \"UNBINDING\",\n    \"reference_no\": \"gw-ref-789012\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-PARTNER-ID", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp")
  .header("Authorization", "Bearer <token>")
  .header("X-PARTNER-ID", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"otp\": \"123456\",\n  \"transaction_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"binding_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"unbind_context\": {\n    \"partner_reference_no\": \"partner-ref-123456\",\n    \"otp_token\": \"otp-token-abc123def456\",\n    \"flow\": \"UNBINDING\",\n    \"reference_no\": \"gw-ref-789012\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-PARTNER-ID"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"otp\": \"123456\",\n  \"transaction_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"binding_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"unbind_context\": {\n    \"partner_reference_no\": \"partner-ref-123456\",\n    \"otp_token\": \"otp-token-abc123def456\",\n    \"flow\": \"UNBINDING\",\n    \"reference_no\": \"gw-ref-789012\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "response_code": "SP000",
  "response_message": "Successfully",
  "data": {
    "transaction_id": "7c2e1a4b-9d6f-4e3a-8b1c-2d4f9a1c5b3e",
    "binding_id": "9a1c5b3e-2d4f-4d8c-93cf-9a1c5b3e2d4f",
    "account_id": "01HZX9JK4M5N6P7Q8R9STUVWXY",
    "merchant_reference": "INV-2026-0001",
    "amount": 150000,
    "currency": "IDR",
    "status": "PENDING",
    "requires_otp": true,
    "paid_at": null,
    "failure_code": null,
    "failure_reason": null,
    "web_redirect_url": null,
    "created_at": "2026-06-04T08:30:01+07:00",
    "updated_at": "2026-06-04T08:31:31+07:00"
  }
}

{
  "response_code": "SP001",
  "response_message": "Transaction Failure",
  "data": null
}

{
  "response_code": "4010000",
  "response_message": "Unauthorized",
  "data": null
}

{
  "response_code": "SP009",
  "response_message": "Transaction Not Found",
  "data": null
}

{
  "response_code": "SP018",
  "response_message": "Validation error",
  "data": {
    "errors": {
      "unbind_context": [
        "unbind_context must include partner_reference_no and otp_token from the original /unbind response"
      ]
    }
  }
}

{
  "response_code": "SP002",
  "response_message": "General Failure",
  "data": null
}

POST

api

v2.0

direct-debit

verify-otp

Verify OTP

curl --request POST \
  --url https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-PARTNER-ID: <api-key>' \
  --data '
{
  "otp": "123456",
  "transaction_id": "01HZX9JK4M5N6P7Q8R9STUVWXY",
  "binding_id": "01HZX9JK4M5N6P7Q8R9STUVWXY",
  "unbind_context": {
    "partner_reference_no": "partner-ref-123456",
    "otp_token": "otp-token-abc123def456",
    "flow": "UNBINDING",
    "reference_no": "gw-ref-789012"
  }
}
'

import requests

url = "https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp"

payload = {
    "otp": "123456",
    "transaction_id": "01HZX9JK4M5N6P7Q8R9STUVWXY",
    "binding_id": "01HZX9JK4M5N6P7Q8R9STUVWXY",
    "unbind_context": {
        "partner_reference_no": "partner-ref-123456",
        "otp_token": "otp-token-abc123def456",
        "flow": "UNBINDING",
        "reference_no": "gw-ref-789012"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "X-PARTNER-ID": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-PARTNER-ID': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    otp: '123456',
    transaction_id: '01HZX9JK4M5N6P7Q8R9STUVWXY',
    binding_id: '01HZX9JK4M5N6P7Q8R9STUVWXY',
    unbind_context: {
      partner_reference_no: 'partner-ref-123456',
      otp_token: 'otp-token-abc123def456',
      flow: 'UNBINDING',
      reference_no: 'gw-ref-789012'
    }
  })
};

fetch('https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'otp' => '123456',
    'transaction_id' => '01HZX9JK4M5N6P7Q8R9STUVWXY',
    'binding_id' => '01HZX9JK4M5N6P7Q8R9STUVWXY',
    'unbind_context' => [
        'partner_reference_no' => 'partner-ref-123456',
        'otp_token' => 'otp-token-abc123def456',
        'flow' => 'UNBINDING',
        'reference_no' => 'gw-ref-789012'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-PARTNER-ID: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp"

	payload := strings.NewReader("{\n  \"otp\": \"123456\",\n  \"transaction_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"binding_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"unbind_context\": {\n    \"partner_reference_no\": \"partner-ref-123456\",\n    \"otp_token\": \"otp-token-abc123def456\",\n    \"flow\": \"UNBINDING\",\n    \"reference_no\": \"gw-ref-789012\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-PARTNER-ID", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp")
  .header("Authorization", "Bearer <token>")
  .header("X-PARTNER-ID", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"otp\": \"123456\",\n  \"transaction_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"binding_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"unbind_context\": {\n    \"partner_reference_no\": \"partner-ref-123456\",\n    \"otp_token\": \"otp-token-abc123def456\",\n    \"flow\": \"UNBINDING\",\n    \"reference_no\": \"gw-ref-789012\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://sandbox-payment-b2b.singapay.id/api/v2.0/direct-debit/verify-otp")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-PARTNER-ID"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"otp\": \"123456\",\n  \"transaction_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"binding_id\": \"01HZX9JK4M5N6P7Q8R9STUVWXY\",\n  \"unbind_context\": {\n    \"partner_reference_no\": \"partner-ref-123456\",\n    \"otp_token\": \"otp-token-abc123def456\",\n    \"flow\": \"UNBINDING\",\n    \"reference_no\": \"gw-ref-789012\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "response_code": "SP000",
  "response_message": "Successfully",
  "data": {
    "transaction_id": "7c2e1a4b-9d6f-4e3a-8b1c-2d4f9a1c5b3e",
    "binding_id": "9a1c5b3e-2d4f-4d8c-93cf-9a1c5b3e2d4f",
    "account_id": "01HZX9JK4M5N6P7Q8R9STUVWXY",
    "merchant_reference": "INV-2026-0001",
    "amount": 150000,
    "currency": "IDR",
    "status": "PENDING",
    "requires_otp": true,
    "paid_at": null,
    "failure_code": null,
    "failure_reason": null,
    "web_redirect_url": null,
    "created_at": "2026-06-04T08:30:01+07:00",
    "updated_at": "2026-06-04T08:31:31+07:00"
  }
}

{
  "response_code": "SP001",
  "response_message": "Transaction Failure",
  "data": null
}

{
  "response_code": "4010000",
  "response_message": "Unauthorized",
  "data": null
}

{
  "response_code": "SP009",
  "response_message": "Transaction Not Found",
  "data": null
}

{
  "response_code": "SP018",
  "response_message": "Validation error",
  "data": {
    "errors": {
      "unbind_context": [
        "unbind_context must include partner_reference_no and otp_token from the original /unbind response"
      ]
    }
  }
}

{
  "response_code": "SP002",
  "response_message": "General Failure",
  "data": null
}

Authorizations

Authorization

string

header

required

JWT issued by POST /api/v1.1/access-token/b2b. Send Authorization: Bearer <token>.

X-PARTNER-ID

string

header

required

Merchant API key (Credential.api_key). Required on every request.

Body

application/json

Submits an OTP to complete either a payment authorization or an unbind operation. Use transaction_id for payment-OTP flows, or binding_id + unbind_context for unbind-OTP flows. Exactly one of these flow definitions must be present.

otp

string

required

OTP value the customer received from their bank.

Required string length: 4 - 8

Example:

"123456"

transaction_id

string<uuid> | null

Required for the payment-OTP flow; the id returned by POST /charge when requires_otp=true.

Example:

"01HZX9JK4M5N6P7Q8R9STUVWXY"

binding_id

string<uuid> | null

Required for the unbinding-OTP flow; together with unbind_context from the original /unbind response.

Example:

"01HZX9JK4M5N6P7Q8R9STUVWXY"

unbind_context

object | null

Verbatim otp_handoff block returned by POST /binding/{binding_id}/unbind (when otp_required=true). Required for the unbinding-OTP flow.

Show child attributes

Response

SP000 Successfully. For the payment flow, data matches DirectDebitTransactionData and status moves PENDING_OTP → PENDING (final SUCCESS arrives via webhook). For the unbinding flow, data matches DirectDebitBindingData; the binding stays ACTIVE until the direct-debit.unbinding.succeeded callback flips it to UNBOUND.

SingaPay Merchant API v2 custom response envelope (ApiResponderHelper::responseJson, ApiResponseTrait). Business outcome is determined by response_code (SP000–SP020), not by HTTP status alone. On success (SP000), data holds the operation payload. On errors, data often includes a message and may echo request fields.

response_code

string

required

SingaPay custom business response code.

Example:

"SP000"

response_message

string

required

Human-readable label paired with response_code.

Example:

"Successfully"

data

object | null

Endpoint-specific payload on success, or error context (validation message, inquiry result with status invalid, etc.).

Getting Started

Security

Accept Money

Send Money

Transaction Records

Money Accounts

Webhook

Authorizations

Body

Response