Alternatif Payment Gateway GratisFree Payment Gateway Alternative

Tentang PayHookAbout PayHook

PayHook adalah aplikasi Android yang membaca notifikasi pembayaran masuk dari aplikasi e-wallet dan mobile banking, lalu mengirimkannya sebagai webhook JSON ke endpoint server yang Anda tentukan. Cocok untuk UMKM, toko online, aplikasi SaaS, dan sistem pencatatan keuangan yang butuh notifikasi pembayaran otomatis tanpa biaya payment gateway. PayHook is an Android app that reads incoming payment notifications from e-wallet and mobile banking apps, then delivers them as JSON webhooks to your server endpoint. Perfect for small businesses, online stores, SaaS apps, and bookkeeping systems that need automatic payment notifications without payment gateway fees.

Alur KerjaHow It Works

Empat langkah dari pembayaran pelanggan hingga notifikasi diterima aplikasi Anda. Four steps from a customer payment to a notification landing in your app.

1. Pelanggan melakukan pembayaranCustomer makes a payment ke QRIS / nomor rekening / e-wallet Anda seperti biasa. to your QRIS / bank account / e-wallet as usual.
2. Aplikasi bank / e-wallet menampilkan notifikasiThe bank / e-wallet app shows a notification seperti “Rp 300.000 sudah masuk ke rekening Anda”. such as “Rp 300,000 has been credited to your account”.
3. PayHook membaca notifikasiPayHook reads the notification , mencocokkan kata kunci pembayaran masuk, dan mengekstrak nominal Rupiah. , matches incoming-payment keywords, and extracts the Rupiah amount.
4. PayHook mengirim webhookPayHook sends a webhook berupa JSON via HTTP POST ke semua endpoint aktif secara paralel. as JSON via HTTP POST to all active endpoints in parallel.

Instalasi & PenggunaanInstall & Usage

Siapkan PayHook dalam beberapa menit. Set up PayHook in a few minutes.

1. Pasang aplikasi PayHookInstall the PayHook app di perangkat Android (min. Android 8.0 / API 26) yang menerima notifikasi pembayaran Anda. Unduh dari Google Play (PayHook - Payment Webhook). on the Android device (min. Android 8.0 / API 26) that receives your payment notifications. Download it from Google Play (PayHook - Payment Webhook).
2. Beri izin Akses NotifikasiGrant Notification Access saat diminta. Izin ini wajib agar PayHook dapat membaca notifikasi. when prompted. This permission is required for PayHook to read notifications.
3. Pilih Aplikasi yang DipantauChoose Monitored Apps — aktifkan e-wallet / bank yang ingin dipantau dari daftar aplikasi terpasang. — enable the e-wallets / banks you want to monitor from your installed apps.
4. Tambahkan WebhookAdd a Webhook dengan URL endpoint, tipe autentikasi, dan token (lihat bagian Konfigurasi). with your endpoint URL, auth type, and token (see the Configuration section).
5. Uji dengan tombol TestTest with the Test button , atau gunakan Simulator di halaman ini, lalu lakukan transaksi kecil untuk verifikasi. , or use the Simulator on this page, then run a small transaction to verify.

Konfigurasi WebhookWebhook Configuration

Setiap webhook memiliki pengaturan berikut. Anda dapat menambahkan lebih dari satu endpoint — semuanya menerima data secara bersamaan. Each webhook has the settings below. You can add more than one endpoint — all of them receive data simultaneously.

Aplikasi DidukungSupported Apps

PayHook dapat memantau notifikasi aplikasi apa pun yang Anda pilih. Berikut daftar yang umum digunakan & teruji. PayHook can monitor notifications from any app you choose. Below are the commonly used & tested ones.

E-Wallet

Bank / Mobile Banking

Format PayloadPayload Format

PayHook mengirim HTTP POST dengan body JSON berikut ke endpoint Anda. PayHook sends an HTTP POST with the following JSON body to your endpoint.

Request Headers

POST /your-endpoint HTTP/1.1
Content-Type: application/json
Accept: application/json
User-Agent: PayHook-Android/2.0
Authorization: Bearer <token>          # tergantung tipe auth / depends on auth type
X-Payhook-Timestamp: 1752300000         # jika HMAC diaktifkan / if HMAC enabled
X-Payhook-Nonce: 9f2c...                 # jika HMAC diaktifkan / if HMAC enabled
X-Payhook-Signature: sha256=<hmac>   # jika HMAC diaktifkan / if HMAC enabled

Body (JSON)

{
  "event_id": "evt_1752300000000_a1b2c3",
  "event_type": "payment.incoming",
  "amount": 300000,
  "source": "BCA Mobile",
  "reference": "PH-1711425600000",
  "timestamp": "2026-03-26 10:26:00",
  "package_name": "com.bca",
  "notification_title": "Uang masuk dari John",
  "notification_text": "Rp 300.000,00 sudah masuk ke rekening Anda",
  "sent_by": "PayHook"
}

Autentikasi & VerifikasiAuth & Verification

PayHook mendukung 4 tipe autentikasi yang dikirim sebagai header HTTP. PayHook supports 4 authentication types, sent as HTTP headers.

Signature (HMAC)Signature (HMAC)

Untuk keamanan tingkat produksi, isi Secret Key pada webhook di aplikasi PayHook. Jika diisi, PayHook menandatangani setiap request dengan HMAC-SHA256 sehingga server Anda bisa memastikan request benar-benar dari PayHook (anti-spoofing) dan bukan kiriman ulang lama (anti-replay). For production-grade security, set a Secret Key on the webhook in the PayHook app. When set, PayHook signs every request with HMAC-SHA256 so your server can verify the request truly comes from PayHook (anti-spoofing) and is not an old replay (anti-replay).

Contoh VerifikasiVerification Example

<?php
$secret = 'YOUR_SECRET_KEY';
$raw = file_get_contents('php://input');
$ts  = $_SERVER['HTTP_X_PAYHOOK_TIMESTAMP'] ?? '';
$sig = $_SERVER['HTTP_X_PAYHOOK_SIGNATURE'] ?? '';

// Tolak jika timestamp terlalu lama (anti-replay), mis. > 5 menit
if (abs(time() - (int)$ts) > 300) { http_response_code(408); exit; }

$expected = 'sha256=' . hash_hmac('sha256', $ts . '.' . $raw, $secret);
if (!hash_equals($expected, $sig)) { http_response_code(401); exit; }

$data = json_decode($raw, true);
// upsert berdasarkan $data['event_id'] (idempoten)
http_response_code(200);

const crypto = require('crypto');
// Pakai raw body: app.use(express.raw({ type: 'application/json' }))
app.post('/payhook', (req, res) => {
  const secret = process.env.PAYHOOK_SECRET;
  const ts  = req.header('X-Payhook-Timestamp') || '';
  const sig = req.header('X-Payhook-Signature') || '';
  const raw = req.body.toString('utf8');

  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300)
    return res.sendStatus(408); // anti-replay

  const expected = 'sha256=' +
    crypto.createHmac('sha256', secret).update(ts + '.' + raw).digest('hex');
  const ok = sig.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
  if (!ok) return res.sendStatus(401);

  const data = JSON.parse(raw);
  // upsert by data.event_id (idempotent)
  res.sendStatus(200);
});

Heartbeat MonitoringHeartbeat Monitoring Opsional

Deteksi otomatis saat HP PayHook mati / offline / kuota habis, sebelum ada komplain pelanggan. Automatically detect when the PayHook phone is off / offline / out of data, before customers complain.

PayHook dapat mengirim ping status berkala ke endpoint monitoring terpisah milik Anda. Jika backend tidak menerima heartbeat dalam batas waktu tertentu, tandai perangkat sebagai offline dan kirim peringatan (WhatsApp/Telegram/email). Fitur ini opsional — atur di aplikasi: Pengaturan → Heartbeat Monitoring. Jika tidak diisi, alur webhook transaksi tetap berjalan seperti biasa (kompatibel mundur). PayHook can send a periodic status ping to a separate monitoring endpoint you own. If your backend does not receive a heartbeat within a threshold, mark the device offline and send an alert (WhatsApp/Telegram/email). This feature is optional — configure it in the app under Settings → Heartbeat Monitoring. If left empty, the transaction webhook flow keeps working as before (backward compatible).

Contoh Payload HeartbeatHeartbeat Payload Example

POST /payhook/heartbeat
Content-Type: application/json
X-Payhook-Timestamp: 1752300000        # jika secret diisi / if secret set
X-Payhook-Signature: sha256=<hmac>  # jika secret diisi / if secret set

{
  "type": "heartbeat",
  "device_id": "ph-a1b2c3d4e5f6",
  "app_version": "1.5.0",
  "listener_connected": true,
  "battery_optimized": false,
  "last_event_at": 1752299880000,
  "sent_at": 1752300000000
}

Contoh IntegrasiIntegration Examples

Contoh menerima & memverifikasi webhook PayHook di berbagai bahasa. Examples of receiving & verifying a PayHook webhook in several languages.

<?php
// webhook.php — endpoint penerima PayHook
$expected = 'YOUR_SECRET_TOKEN';
$auth = $_SERVER['HTTP_AUTHORIZATION'] ?? '';

if ($auth !== 'Bearer ' . $expected) {
    http_response_code(401);
    exit(json_encode(['error' => 'Unauthorized']));
}

$payload = json_decode(file_get_contents('php://input'), true);
if (!$payload) { http_response_code(400); exit; }

// Idempotent upsert by event_id
$eventId = $payload['event_id'] ?? '';
if ($eventId === '') { http_response_code(422); exit(json_encode(['error' => 'Missing event_id'])); }

// Simpan pembayaran
file_put_contents('payments.log',
    sprintf("[%s] %s Rp%s event_id=%s ref=%s\n",
        $payload['timestamp'], $payload['source'],
        number_format($payload['amount'], 0, ',', '.'),
        $eventId,
        $payload['reference']
    ), FILE_APPEND);

http_response_code(200);
echo json_encode(['status' => 'ok']);

// routes/api.php
Route::post('/payhook', function (Illuminate\Http\Request $request) {
    if ($request->bearerToken() !== config('services.payhook.token')) {
        return response()->json(['error' => 'Unauthorized'], 401);
    }

    $data = $request->validate([
        'event_id'  => 'required|string',
        'amount'    => 'required|integer',
        'source'    => 'required|string',
        'reference' => 'required|string',
        'timestamp' => 'required|string',
    ]);

    Payment::updateOrCreate(
        ['event_id' => $data['event_id']], // idempoten
        ['amount' => $data['amount'], 'source' => $data['source'], 'reference' => $data['reference']]
    );

    return response()->json(['status' => 'ok']);
});

// server.js — Express
const express = require('express');
const app = express();
app.use(express.json());

const TOKEN = process.env.PAYHOOK_TOKEN;

app.post('/payhook', (req, res) => {
  if (req.headers.authorization !== `Bearer ${TOKEN}`) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

    const { event_id, amount, source, reference, timestamp } = req.body;
    console.log(`[${timestamp}] ${source} Rp${amount} event_id=${event_id} ref=${reference}`);

    // TODO: simpan ke database (idempoten berdasarkan event_id)
  res.json({ status: 'ok' });
});

app.listen(3000, () => console.log('PayHook listener on :3000'));

# app.py — Flask
import os
from flask import Flask, request, jsonify

app = Flask(__name__)
TOKEN = os.environ["PAYHOOK_TOKEN"]

@app.post("/payhook")
def payhook():
    if request.headers.get("Authorization") != f"Bearer {TOKEN}":
        return jsonify(error="Unauthorized"), 401

        data = request.get_json(silent=True) or {}
    print(f"[{data.get('timestamp')}] {data.get('source')} "
            f"Rp{data.get('amount')} event_id={data.get('event_id')} "
            f"ref={data.get('reference')}")

    # TODO: simpan ke DB (idempoten berdasarkan event_id)
    return jsonify(status="ok")

if __name__ == "__main__":
    app.run(port=3000)

Simulator / SandboxSimulator / Sandbox

Susun payload PayHook (payment/heartbeat), salin sebagai cURL/kode, atau kirim uji coba langsung ke endpoint Anda — tanpa perlu transaksi sungguhan. Build PayHook payloads (payment/heartbeat), copy them as cURL/code, or send a live test to your endpoint — without any real transaction.

// klik "Buat Payload"

FAQ & Pemecahan MasalahTroubleshooting

Webhook tidak terkirim, kenapa?Webhook not being sent, why?

Pastikan izin Akses Notifikasi aktif, aplikasi sumber ada di daftar dipantau, optimisasi baterai dinonaktifkan, dan URL endpoint menggunakan HTTPS yang valid. Cek log aktivitas di aplikasi untuk kode HTTP respons. Ensure Notification Access is granted, the source app is in the monitored list, battery optimization is disabled, and the endpoint URL is valid HTTPS. Check the in-app activity log for the response HTTP code.

Nominal terbaca salah / kosong?Amount parsed wrong / empty?

PayHook mengekstrak angka dari teks notifikasi (mis. Rp 300.000, IDR 300,000). Jika format bank Anda tidak dikenali, sesuaikan kata kunci di aplikasi. PayHook extracts numbers from the notification text (e.g. Rp 300.000, IDR 300,000). If your bank's format is not recognized, adjust the keywords in the app.

Bagaimana menghindari data ganda?How to avoid duplicate data?

Gunakan field event_id sebagai kunci idempoten saat menyimpan ke database. Nilai ini tetap sama saat retry, sehingga aman untuk mekanisme upsert dan mencegah transaksi ganda. Use the event_id field as your idempotency key when saving to the database. It stays stable across retries, making upsert safe and preventing duplicates.

Apakah aman untuk produksi?Is it production-safe?

PayHook cocok untuk volume kecil–menengah. Untuk keandalan tinggi, gunakan perangkat khusus yang selalu online, dan verifikasi pembayaran penting secara manual atau via mutasi rekening. PayHook suits small–medium volume. For high reliability, use a dedicated always-online device, and verify important payments manually or via account statements.