AutoNokosAutoNokos
Kembali ke Beranda

Dokumentasi API Center

REST API v1 — beli OTP, saldo, deposit, webhook · semua contoh respons real

Ikhtisar

Base URL
https://autonokos.app/api/v1
Autentikasi
Header X-API-Key: ak_live_…
Rate limit
50 request / menit / key · 300 / menit / IP
Batas order
Tidak ada — order sebanyak saldo mampu
Format
JSON · timestamp milidetik (epoch) · waktu aktif order 20 menit

Autentikasi

Buat key di Dashboard → API Center. Key hanya tampil sekali saat dibuat. Semua endpoint kecuali GET /status wajib key.

curl -H "X-API-Key: ak_live_xxxxxxxx" \
  https://autonokos.app/api/v1/balance
200 OK
{"balance":27273,"currency":"IDR","name":"mutiara","email":"[email protected]"}

Tanpa / salah key:

401 ERROR
{"error":"API key tidak valid. Kirim header X-API-Key.","code":"BAD_KEY"}
401 ERROR
{"error":"API key tidak ditemukan atau sudah dicabut.","code":"BAD_KEY"}

Alternatif: Authorization: Bearer ak_live_…. Simpan key di environment variable, jangan di kode publik.

Error Umum (berlaku untuk semua endpoint)

Error autentikasi, rate limit, dan maintenance bisa muncul di endpoint mana pun. Error spesifik tiap endpoint (order, deposit, webhook) ada di bagian Contoh error pada card masing-masing endpoint di bawah. Semua error memakai bentuk {"error":"pesan","code":"KODE"}.

Saldo

GET/balance+

Fungsi: Cek saldo + identitas akun pemilik key (name, email) dalam Rupiah. Panggil sebelum order untuk memastikan dana mencukupi — nilai saldo sama dengan dashboard web. Tidak ada kuota harian; hanya rate limit 50 request/menit.

Contoh request

curl -H "X-API-Key: ak_live_xxx" https://autonokos.app/api/v1/balance

Respons sukses

200 OK
{"balance":27273,"currency":"IDR","name":"mutiara","email":"[email protected]"}

Contoh error

401 ERROR
{"error":"API key tidak valid. Kirim header X-API-Key.","code":"BAD_KEY"}
403 ERROR
{"error":"API Center dinonaktifkan admin.","code":"API_DISABLED"}
GET/servers+

Fungsi: Daftar server OTP yang bisa dipakai (hanya yang aktif & bukan maintenance), beserta diskon aktif yang sedang berlaku. Harga final selalu dihitung backend saat order (harga API bisa berbeda dari harga web bila admin menyetel markup API Center).

Contoh request

curl -H "X-API-Key: ak_live_xxx" https://autonokos.app/api/v1/servers

Respons sukses

200 OK
{
  "servers": [
    { "id": 2, "label": "Server 2" },
    { "id": 3, "label": "Server 3" },
    { "id": 4, "label": "Server 4" },
    { "id": 5, "label": "Server 5" }
  ],
  "discount": { "mode": "nominal", "value": 100 }
}

Contoh error

500 ERROR
{"error":"Gagal memuat katalog"}

Katalog & Harga per Server

Tiap server punya katalog sendiri (layanan, negara, operator, dan daftar harga). Semua field price / fromPrice sudah harga jual final (termasuk markup & diskon) dalam Rupiah. Hasil katalog dipakai sebagai parameter POST /orders. Katalog di-cache 60 detik.

Server 1Layanan internasional — alur: services → countries → providers → operators+

Cari layanan (serviceCode) → negara (numberId) → pilihan harga (providerId) → operator opsional, lalu order. /1/providers menyediakan daftar harga + stok per negara.

EndpointFungsiParameter
GET /1/servicesDaftar layanan (kode + nama)—
GET /1/countriesNegara tersedia + numberId + harga mulaiservice (wajib)
GET /1/providersDaftar pilihan harga: providerId, price, count (stok)service, numberId
GET /1/operatorsOperator seluler (Telkomsel, AXIS, ...) untuk preferensicountry (kode ISO), provider

GET /1/services

{
  "services": [
    { "code": "13", "name": "WhatsApp" },
    { "code": "5", "name": "Telegram" },
    { "code": "ka", "name": "Shopee" },
    { "code": "121", "name": "Tokopedia" }
  ]
}

GET /1/countries?service=13

{
  "countries": [
    { "numberId": 2381, "name": "Indonesia", "iso": "id", "fromPrice": 3900 },
    { "numberId": 2387, "name": "Philippines", "iso": "ph", "fromPrice": 5700 },
    { "numberId": 2410, "name": "Malaysia", "iso": "my", "fromPrice": 7100 },
    { "numberId": 2429, "name": "Colombia", "iso": "co", "fromPrice": 3450 }
  ]
}

GET /1/providers?service=13&numberId=2381 (daftar harga + stok)

{
  "country": { "name": "Indonesia", "iso": "" },
  "providers": [
    { "providerId": 3482, "price": 3900, "count": 200 },
    { "providerId": 3029, "price": 4050, "count": 156 },
    { "providerId": 3479, "price": 4200, "count": 316 },
    { "providerId": 3480, "price": 4250, "count": 193 }
  ]
}
Server 2Aplikasi populer — alur: platforms → countries → operators → products+

Pilih aplikasi (platformId) → negara (countryId) → operator opsional → produk dari /2/products yang sudah berisi harga jual + stok, lalu order dengan productId.

EndpointFungsiParameter
GET /2/platformsDaftar aplikasi (id + nama)—
GET /2/countriesDaftar negara (id + nama)—
GET /2/operatorsOperator per negara (opsional, preferensi)country, platform
GET /2/productsProduk + harga jual + stok (berpaginasi)country, platform, operator?, page?

GET /2/platforms

{
  "platforms": [
    { "id": 1, "name": "WhatsApp" },
    { "id": 2, "name": "Telegram" },
    { "id": 3, "name": "Instagram / Threads" },
    { "id": 7, "name": "TikTok / Douyin" }
  ]
}

GET /2/operators?country=7&platform=1 (contoh: Telkomsel)

{
  "operators": [
    { "operatorId": null, "name": "Any" },
    { "operatorId": 308, "name": "AXIS (XL Axiata)" },
    { "operatorId": 312, "name": "Telkomsel" }
  ]
}

GET /2/products?country=7&platform=1 (daftar harga + stok)

{
  "products": [
    { "id": 1369240044, "name": "WhatsApp - Indonesia", "price": 4002, "available": 294 },
    { "id": 1369321855, "name": "WhatsApp - Indonesia", "price": 4042, "available": 433 },
    { "id": 1369400277, "name": "WhatsApp - Indonesia", "price": 4061, "available": 276 }
  ],
  "meta": { "page": 1, "limit": 8, "count": 0 }
}
Server 3Banyak layanan lokal & global — alur: services → countries → operators (harga)+

Cari layanan (code, misal ka = Shopee) → negara (countryId) → /3/operators sekaligus menampilkan daftar harga (price) + stok (count) tiap pilihan, lalu order.

EndpointFungsiParameter
GET /3/servicesDaftar layanan (code + nama), dukung pencarian qq?
GET /3/countriesDaftar negara—
GET /3/operatorsPilihan harga: providerId, label, price, countservice, country

GET /3/services?q=sho

{ "services": [ { "code": "ka", "name": "Shopee" } ] }

GET /3/operators?service=ka&country=1 (daftar harga + stok)

{
  "operators": [
    { "providerId": "3451", "label": "Provider 3451", "price": 601, "count": 24939 },
    { "providerId": "3335", "label": "Provider 3335", "price": 619, "count": 99 },
    { "providerId": "3193", "label": "Provider 3193", "price": 3931, "count": 11277 },
    { "providerId": "3168", "label": "Provider 3168", "price": 4878, "count": 2204 }
  ]
}
Server 4Layanan dalam negeri — daftar layanan + stok + harga dalam satu endpoint+

Satu endpoint sudah mengembalikan id (serviceId untuk order), stok, dan harga jual final. Paling simpel: GET /4/services → POST /orders dengan serviceId.

EndpointFungsiParameter
GET /4/servicesLayanan aktif: id, name, stock, price (harga jual)—

GET /4/services (stok + harga)

{
  "services": [
    { "id": 44, "name": "Ajaib", "stock": 14446, "price": 1100 },
    { "id": 31, "name": "Alfagift", "stock": 13822, "price": 1200 },
    { "id": 220, "name": "Blibli", "stock": 14448, "price": 1100 },
    { "id": 35, "name": "Chatgpt", "stock": 14441, "price": 1520 }
  ]
}
Server 5Katalog luas internasional — alur: services → countries → prices → operators+

Cari layanan (code, contoh: wa, tg, fb, ka) → negara → harga khusus pasangan itu lewat /5/prices (price sudah Rupiah, priceUsd asli, count stok) → operator opsional (preferensi, tidak memengaruhi harga), lalu order. Tidak semua pasangan layanan+negara tersedia — cek /5/prices dulu sebelum order.

EndpointFungsiParameter
GET /5/servicesDaftar layanan (code + nama), dukung pencarian qq?
GET /5/countriesDaftar negara (id + nama)—
GET /5/pricesHarga pasangan layanan+negara: price (Rp), priceUsd, countservice, country
GET /5/operatorsOperator seluler negara (preferensi, opsional)country

GET /5/services?q=shopee

{ "services": [ { "code": "ka", "name": "shopee.com" } ] }

GET /5/operators?country=1

{
  "operators": [
    { "id": "lycamobile", "label": "Lycamobile" },
    { "id": "vodafone", "label": "Vodafone" },
    { "id": "kyivstar", "label": "Kyivstar" }
  ]
}

GET /5/prices?service=…&country=… (bila tidak tersedia):

{"error":"Harga tidak tersedia untuk pilihan ini"}

Struktur respons sukses /5/prices:

{ "price": 1650, "priceUsd": 0.09, "count": 120 }

Order & OTP

GET/orders+

Fungsi: Riwayat order milik pemilik key, terbaru di atas, berpaginasi. Field check berisi hasil auto-cek registrasi nomor (Shopee/Tokopedia/WhatsApp). Status PENDING = menunggu OTP, COMPLETED = OTP masuk, EXPIRED/CANCELLED = ditutup (cek refunded).

Parameter

ParameterTipeWajibKeterangan
pagenumberTidakHalaman, default 1
limitnumberTidakPer halaman, default 20, maks 50
statusstringTidakPENDING | COMPLETED | EXPIRED | CANCELLED

Contoh request

curl -H "X-API-Key: ak_live_xxx" "https://autonokos.app/api/v1/orders?page=1&limit=1"

Respons sukses

200 OK
{
  "orders": [
    {
      "id": 127,
      "serverId": 2,
      "providerRef": "s2-19328990",
      "serviceName": "Shopee",
      "serviceCode": "21",
      "countryName": "Indonesia",
      "countryCode": "",
      "operatorName": "",
      "phone": "6283874366892",
      "price": 637,
      "status": "EXPIRED",
      "otp": "",
      "smsFull": "",
      "createdAt": 1791782771935,
      "expiresAt": 1791783971935,
      "finishedAt": null,
      "closedAt": null,
      "refunded": true,
      "refundNote": "Timeout 20 menit tanpa OTP",
      "resendSupported": false,
      "canResend": false,
      "resendCount": 0,
      "resendMax": 5,
      "resendLastAt": 0,
      "resendAvailableAt": 1791782831935,
      "check": {
        "platform": "shopee",
        "status": "done",
        "registered": false,
        "message": "Tidak terdaftar di Shopee",
        "checkedAt": 1791795352525
      }
    }
  ],
  "total": 9,
  "page": 1,
  "pages": 9
}

Contoh error

401 ERROR
{"error":"API key tidak ditemukan atau sudah dicabut.","code":"BAD_KEY"}
500 ERROR
{"error":"Gagal memuat pesanan"}
GET/orders/:id+

Fungsi: Detail satu order + OTP terbaru. Endpoint ini juga memicu pengecekan ke provider (state PENDING → COMPLETED lebih cepat). Jadikan polling utama: ulangi tiap 5 detik sampai status COMPLETED atau expiresAt terlewati.

Contoh request

curl -H "X-API-Key: ak_live_xxx" https://autonokos.app/api/v1/orders/127

Respons sukses

200 OK
{
  "order": {
    "id": 127,
    "serverId": 2,
    "providerRef": "s2-19328990",
    "serviceName": "Shopee",
    "phone": "6283874366892",
    "price": 637,
    "status": "EXPIRED",
    "otp": "",
    "refunded": true,
    "refundNote": "Timeout 20 menit tanpa OTP",
    "createdAt": 1791782771935,
    "expiresAt": 1791783971935
  }
}

Contoh error

404 ERROR
{"error":"Pesanan tidak ditemukan"}
POST/orders+

Fungsi: Beli nomor. Body sama persis dengan web — ambil serviceCode/platformId/numberId dari katalog. Harga = harga web + markup API Center (lihat api_pricing di /servers), langsung terpotong dari saldo. Maksimal 1 proses create berjalan per akun. Jika 20 menit tanpa OTP → refund otomatis (refunded = true).

Parameter

ParameterTipeWajibKeterangan
serverIdnumberYaID server dari /servers (1-5)
serviceCodestringYa*Server 1/3/5 - kode dari /:serverId/services
numberIdnumberYa*Server 1 - dari /1/countries
providerIdnumberYa*Server 1 (dari /1/providers) & Server 3 (dari /3/operators)
operatorIdnumberTidakServer 1/2 - operator pilihan dari /:serverId/operators
platformIdnumberYa*Server 2 - dari /2/platforms
countryIdnumberYa*Server 2/3 - dari /:serverId/countries (Server 5: string)
productIdnumberYa*Server 2 - dari /2/products (sudah berisi harga)
serviceIdnumberYa*Server 4 - dari /4/services
countryIdstringYa*Server 5 - ID negara dari /5/countries
countryCodestringTidakServer 5 - kode negara (ISO) untuk riwayat
serviceNamestringTidakNama layanan untuk riwayat
countryNamestringTidakNama negara untuk riwayat

Contoh request

curl -X POST -H "X-API-Key: ak_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"serverId":1,"serviceCode":"ka","serviceName":"Shopee","numberId":1}' \
  https://autonokos.app/api/v1/orders

Respons sukses

201 OK
{
  "order": {
    "id": 128,
    "serverId": 1,
    "providerRef": "s1-88213",
    "serviceName": "Shopee",
    "serviceCode": "ka",
    "countryName": "Indonesia",
    "phone": "081234567890",
    "price": 1650,
    "status": "PENDING",
    "otp": "",
    "createdAt": 1791811117195,
    "expiresAt": 1791812317195,
    "finishedAt": null,
    "closedAt": null,
    "refunded": false,
    "refundNote": "",
    "resendSupported": true,
    "canResend": false,
    "resendCount": 0,
    "resendMax": 5,
    "check": { "platform": "shopee", "status": "pending" }
  }
}

Contoh error

402 ERROR
{"error":"saldo tidak cukup","code":"INSUFFICIENT"}
400 ERROR
{"error":"Server tidak valid.","code":"BAD_SERVER"}
409 ERROR
{"error":"Harga tidak tersedia lagi. Muat ulang katalog.","code":"PRICE_REFRESH"}
409 ERROR
{"error":"Pesanan sebelumnya masih diproses. Tunggu beberapa detik lalu coba lagi.","code":"IN_FLIGHT"}
409 ERROR
{"error":"Stok sedang habis.","code":"OUT_OF_STOCK"}
403 ERROR
{"error":"Server tidak tersedia.","code":"SERVER_UNAVAILABLE"}
503 ERROR
{"error":"Pembelian OTP sedang dalam pemeliharaan.","code":"OTP_MAINTENANCE"}
502 ERROR
{"error":"Provider menolak pesanan.","code":"PROVIDER_ERROR"}
POST/orders/:id/cancel+

Fungsi: Batalkan order PENDING dan terima refund penuh ke saldo. Bisa setelah 3 menit sejak order (kecuali Server 4 & 5 yang boleh langsung). Tidak bisa jika OTP sudah masuk.

Contoh request

curl -X POST -H "X-API-Key: ak_live_xxx" https://autonokos.app/api/v1/orders/128/cancel

Respons sukses

200 OK
{
  "order": {
    "id": 128,
    "status": "CANCELLED",
    "refunded": true,
    "refundNote": "Dibatalkan user",
    "phone": "081234567890",
    "price": 1650
  }
}

Contoh error

400 ERROR
{"error":"Pembatalan baru bisa dilakukan setelah 3 menit sejak order (sisa 2 menit 14 detik).","code":"TOO_EARLY"}
409 ERROR
{"error":"OTP sudah masuk, pesanan diselesaikan.","code":"OTP_ARRIVED"}
400 ERROR
{"error":"Pesanan sudah selesai.","code":"BAD_STATUS"}
503 ERROR
{"error":"Refund belum bisa diproses. Coba lagi sebentar lagi.","code":"CANCEL_UNCERTAIN"}
502 ERROR
{"error":"Provider menolak pembatalan. Coba lagi nanti.","code":"CANCEL_FAILED"}
404 ERROR
{"error":"Pesanan tidak ditemukan"}

Deposit QRIS

POST/deposits+

Fungsi: Buat tagihan deposit QRIS. Respons berisi id (untuk polling), qrPayload (string untuk generate QR), totalPay (termasuk fee), dan expiresAt. Saldo masuk otomatis beberapa detik setelah bayar. Nominal sama yang masih PENDING menolak duplikat (DUP_PENDING).

Parameter

ParameterTipeWajibKeterangan
amountnumberYaNominal Rupiah, minimal Rp1.000

Contoh request

curl -X POST -H "X-API-Key: ak_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"amount":5000}' https://autonokos.app/api/v1/deposits

Respons sukses

201 OK
{
  "deposit": {
    "id": 35,
    "invoiceId": "GHU20261012ZXFIW5K2ETWO",
    "amount": 5000,
    "totalPay": 5237,
    "fee": 237,
    "qrPayload": "00020101021226670016COM.NOBUBANK.WWW0118936005030000086...",
    "status": "PENDING",
    "createdAt": 1791813849640,
    "expiresAt": 1791814449640,
    "paidAt": null
  }
}

Contoh error

400 ERROR
{"error":"Minimal deposit Rp1.000","code":"MIN_DEPOSIT"}
409 ERROR
{"error":"Transaksi dengan nominal sama masih aktif. Coba lagi beberapa saat.","code":"DUP_PENDING"}
502 ERROR
{"error":"Gateway QRIS sedang tidak tersedia","code":"GATEWAY_DOWN"}
GET/deposits/:id+

Fungsi: Cek status 1 deposit. Polling endpoint ini sampai status = PAID (saldo otomatis bertambah), atau CANCELLED/EXPIRED. PENDING yang lewat expiresAt kedaluwarsa sendiri.

Contoh request

curl -H "X-API-Key: ak_live_xxx" https://autonokos.app/api/v1/deposits/35

Respons sukses

200 OK
{
  "deposit": {
    "id": 35,
    "invoiceId": "GHU20261012ZXFIW5K2ETWO",
    "amount": 5000,
    "totalPay": 5237,
    "fee": 237,
    "status": "PENDING",
    "createdAt": 1791813849640,
    "expiresAt": 1791814449640,
    "paidAt": null
  }
}

Contoh error

404 ERROR
{"error":"Deposit tidak ditemukan"}
500 ERROR
{"error":"Gagal memuat deposit"}
GET/deposits+

Fungsi: Riwayat deposit milik pemilik key, terbaru di atas, berpaginasi (sama seperti /orders).

Parameter

ParameterTipeWajibKeterangan
pagenumberTidakHalaman, default 1
limitnumberTidakPer halaman, default 20, maks 50

Contoh request

curl -H "X-API-Key: ak_live_xxx" "https://autonokos.app/api/v1/deposits?limit=1"

Respons sukses

200 OK
{
  "deposits": [
    {
      "id": 35,
      "invoiceId": "GHU20261012ZXFIW5K2ETWO",
      "amount": 5000,
      "totalPay": 5237,
      "fee": 237,
      "status": "PENDING",
      "createdAt": 1791813849640,
      "expiresAt": 1791814449640,
      "paidAt": null
    }
  ],
  "total": 15,
  "page": 1,
  "pages": 2
}
GET/deposits/active+

Fungsi: Deposit PENDING terakhir — dipakai untuk membuka ulang QR yang belum dibayar tanpa membuat tagihan baru.

Contoh request

curl -H "X-API-Key: ak_live_xxx" https://autonokos.app/api/v1/deposits/active

Respons sukses

200 OK
{"deposit":null}
POST/deposits/:id/cancel+

Fungsi: Batalkan deposit yang belum dibayar (status kembali CANCELLED). Jika sudah PAID, ditolak dengan 409 — dana tetap masuk.

Contoh request

curl -X POST -H "X-API-Key: ak_live_xxx" https://autonokos.app/api/v1/deposits/35/cancel

Respons sukses

200 OK
{
  "deposit": {
    "id": 35,
    "invoiceId": "GHU20261012ZXFIW5K2ETWO",
    "status": "CANCELLED"
  }
}

Contoh error

409 ERROR
{"error":"Pembayaran sudah diterima, deposit tidak bisa dibatalkan.","code":"ALREADY_PAID","deposit":{ "id": 35, "status": "PAID" }}
404 ERROR
{"error":"Deposit tidak ditemukan"}

Webhook & Event

Server kamu menerima POST otomatis saat event terjadi — tanpa polling. URL wajib HTTPS. Daftarkan lewat API atau Dashboard → API Center.

GET/webhooks+

Fungsi: Konfigurasi webhook milik akun. Secret ditampilkan tersembunyi (masked) — hanya tampil penuh saat baru dibuat/di-regenerasi.

Contoh request

curl -H "X-API-Key: ak_live_xxx" https://autonokos.app/api/v1/webhooks

Respons sukses

200 OK
{
  "webhook": {
    "url": "https://kamu.com/hook",
    "events": "otp_received,order_refunded",
    "active": true,
    "secretMasked": "9b0082********",
    "createdAt": 1791811117553
  }
}
POST/webhooks+

Fungsi: Simpan atau ganti webhook (satu URL per akun). Respons mengembalikan secret secara penuh SEKALI — simpan untuk verifikasi signature. Tambahkan regenerateSecret: true untuk memutar secret (secret lama langsung tidak berlaku).

Parameter

ParameterTipeWajibKeterangan
urlstringYaURL HTTPS penerima POST
eventsstringTidakKoma: order_created,otp_received,order_refunded (default: otp_received,order_refunded)
regenerateSecretbooleanTidaktrue = buat secret baru

Contoh request

curl -X POST -H "X-API-Key: ak_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://kamu.com/hook","events":"order_created,otp_received,order_refunded"}' \
  https://autonokos.app/api/v1/webhooks

Respons sukses

201 OK
{
  "webhook": {
    "url": "https://kamu.com/hook",
    "events": "order_created,otp_received,order_refunded",
    "active": true,
    "secretMasked": "9b0082********",
    "createdAt": 1791811117553
  },
  "secret": "9b00824c2a3650cdce725b25f21778df8c834e16"
}

Contoh error

400 ERROR
{"error":"URL webhook wajib HTTPS.","code":"BAD_URL"}
401 ERROR
{"error":"API key tidak ditemukan atau sudah dicabut.","code":"BAD_KEY"}
DELETE/webhooks+

Fungsi: Hapus webhook — tidak ada lagi event yang dikirim ke server kamu.

Contoh request

curl -X DELETE -H "X-API-Key: ak_live_xxx" https://autonokos.app/api/v1/webhooks

Respons sukses

200 OK
{"ok":true}

Payload tiap event

POST JSON dengan header X-Autonokos-Event, X-Autonokos-Timestamp, dan X-Autonokos-Signature.

order_created — order lewat API berhasil dibuat:

{
  "event": "order_created",
  "id": "order_created_1791811117_ab12cd",
  "created_at": 1791811117,
  "data": {
    "id": 128, "ref": "s1-88213", "phone": "081234567890",
    "service": "Shopee", "price": 1650, "status": "PENDING"
  }
}

otp_received — kode OTP masuk (juga untuk kode ke-2, field resend: true):

{
  "event": "otp_received",
  "id": "otp_received_1791811200_ff33aa",
  "created_at": 1791811200,
  "data": {
    "id": 128, "ref": "s1-88213", "phone": "081234567890",
    "service": "Shopee", "otp": "824193"
  }
}

order_refunded — order gagal, saldo kembali:

{
  "event": "order_refunded",
  "id": "order_refunded_1791812400_99aa11",
  "created_at": 1791812400,
  "data": {
    "id": 128, "phone": "081234567890", "service": "Shopee",
    "amount": 1650, "reason": "Provider menutup order (EXPIRED)"
  }
}

Aturan pengiriman & verifikasi signature

const crypto = require('crypto');

function verify(rawBody, headers, secret) {
  const ts = headers['x-autonokos-timestamp'];
  const sig = (headers['x-autonokos-signature'] || '').replace('sha256=', '');
  const expect = crypto.createHmac('sha256', secret)
    .update(ts + '.' + rawBody).digest('hex');
  if (sig !== expect) return false;                 // signature salah
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false; // >5 menit
  return true;
}

Contoh Alur Lengkap

1. GET  /api/v1/balance                 → {"balance":27273,"name":...}  cek saldo+akun
2. GET  /api/v1/1/services              → cari code "ka" (Shopee)
3. POST /api/v1/orders {"serverId":1,..} → 201, order.id + phone + check
4. GET  /api/v1/orders/128              → poll tiap 5 detik
   (atau tunggu webhook otp_received)
5. status "COMPLETED" → baca field otp → "824193" → selesai.
6. Tidak dapat OTP sampai expiresAt? → refund otomatis, saldo kembali.

Ada masalah dengan integrasi? Hubungi support sertakan contoh request, header X-Request time, dan kode error.