roedyrustamroedyrustam/doku-gemini-mcp/skills/doku-payment-gateway/SKILL.md

doku-payment-gateway

Skill2 starsChanged 10 days agoMITView on GitHub

Expert guide for integrating DOKU Payment Gateway (Jokul API v2 & SNAP API v1.0). Covers HMAC-SHA256 & HMAC-SHA512 signature calculation, Checkout & Direct APIs (Virtual Account, QRIS, E-Wallet, Credit Card, Direct Debit, PayLater, Refund), status inquiry, webhook notification verification, and sandbox/production setup / Panduan ahli integrasi DOKU Payment Gateway.

1 other project uses a version of this.

Adopted by

Most recently taken up by

roedyrustam/vibes-plugtheir own version, first seen Oct 5, 2026

Other versions1 project uses a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 1
roedyrustam/vibes-plug★ 75same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository12 other files it gives its agents.
- AGENTS.mdAGENTS.md
- detect-stackSkill
- doku-checkoutSkill
- doku-mcp-serverSkill
- fetch-api-specSkill
- generate-postmanSkill
- mock-testSkill
- production-checklistSkill
- setup-credentialsSkill
- setup-projectSkill
- upgradeSkill
- webhook-receiverSkill

The file

We split this skill into the rules it gives an agent

1 rule. About 0 are common, 0 are distinctive, and 1 is very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈0
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Very specific:
MANDATORY: When testing in Sandbox mode and needing to access the Payment Simulator, the AI Agent MUST use this exact URL: …
line 127

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

DOKU Payment Gateway Integration / Integrasi Payment Gateway DOKU

English | Bahasa Indonesia

<a name="english"></a>

English

Description

Expert guide for implementing DOKU Payment Gateway (Jokul API v2 & SNAP API v1.0) integrations based on official DOKU Developers Documentation. Covers authentication headers, SHA-256 Digest generation, HMAC-SHA256 request signature construction, SNAP Symmetric/Asymmetric signatures, Webhook notification verification, Checkout Payment Links, Direct Payments (Virtual Account, QRIS, E-Wallet, Credit Card, Direct Debit, PayLater, Refund), Status Inquiry, error handling, and sandbox/production deployment.

Trigger Conditions

Activate this skill when the user is:

Building or refactoring DOKU Payment Gateway integration in Node.js, TypeScript, Python, Go, PHP, or Java.
Implementing HMAC-SHA256 signature calculations or notification signature verification for DOKU API.
Integrating DOKU Checkout JS library (jokul-checkout.js) on the frontend for pop-up or redirect modes.
Setting up DOKU Checkout, Virtual Account (BCA, Mandiri, BRI, BNI, Permata, Danamon, CIMB), QRIS, E-Wallet (OVO, ShopeePay, DANA, LinkAja), Credit Card, Direct Debit, or PayLater (Kredivo, Indodana, Akulaku) APIs.
Setting up Account Binding, Direct Debit recurring payments, or Online Refunds.
Querying order status via /orders/v1/status/:invoice_number or SNAP query endpoints.
Debugging DOKU API authorization errors (Authorization Failed, invalid signature, incorrect timestamp format).

Core Architecture & Credentials

Environment Gateways & Testing Tools

Environment	Base URL	Dashboard / Back Office	Payment Simulator
Sandbox	`https://api-sandbox.doku.com`	`https://sandbox.doku.com/bo/login`	`https://sandbox.doku.com/gtw-config-v2/simulator`
Production	`https://api.doku.com`	`https://dashboard.doku.com`	N/A

Mandatory Headers (Jokul API v2 Standard)

Client-Id: Merchant Client ID from DOKU Back Office.
Request-Id: Unique UUID v4 per HTTP request.
Request-Timestamp: UTC ISO8601 string without milliseconds (e.g. 2026-08-09T00:00:00Z).
Signature: Format HMACSHA256=<base64-signature>.

Note: Request-Target and Digest are used only for Signature calculation component string, NOT as HTTP Request Headers.

Mandatory Headers (SNAP BI / SNAP Adapter Standard)

X-TIMESTAMP: UTC ISO8601 string with offset (e.g. 2026-08-09T00:00:00+07:00).
X-SIGNATURE: HMAC-SHA512 or RSA-SHA256 signature string.
X-CLIENT-KEY: Merchant Client ID.
X-PARTNER-ID: Merchant Client ID.
X-EXTERNAL-ID: Unique trace ID per request.
CHANNEL-ID: Channel identification header.

Frontend Integration (DOKU Checkout JS)

Viewport: Requires <meta name="viewport" content="width=device-width, initial-scale=1">
JS Script (Sandbox): <script src="https://sandbox.doku.com/jokul-checkout-js/v1/jokul-checkout-1.0.0.js"></script>
JS Script (Production): <script src="https://jokul.doku.com/jokul-checkout-js/v1/jokul-checkout-1.0.0.js"></script>
Invokation: loadJokulCheckout(payment.url)

Signature Calculation Formulas

1. Jokul API v2 Signature Standard

Digest Calculation (POST / PUT / PATCH):

Raw Body JSON -> SHA-256 Hash -> Base64 Encode -> Digest String

Component String Assembly:

Client-Id:<CLIENT_ID>\nRequest-Id:<REQUEST_ID>\nRequest-Timestamp:<TIMESTAMP>\nRequest-Target:<TARGET_PATH>\nDigest:<DIGEST_STRING>

Note: For GET requests, omit \nDigest:<DIGEST_STRING>.

HMAC-SHA256 Signing:

Raw String + Secret Key -> HMAC-SHA256 Hash -> Base64 Encode -> Prepend "HMACSHA256="

2. SNAP Symmetric Signature Standard

String to Sign:

HTTPMethod + ":" + EndpointUrl + ":" + AccessToken + ":" + Lowercase(HexEncode(SHA-256(MinifiedRequestBody))) + ":" + Timestamp

HMAC-SHA512 Signing:

HMAC-SHA512(SecretKey, StringToSign) -> Base64 Encode -> Signature

Endpoints Reference Summary

Channel / Feature	Endpoint	Method	Key Parameters
DOKU Checkout	`/checkout/v1/payment`	POST	`order.amount`, `order.invoice_number`, `customer.name`, `customer.email`
Cancel Checkout Order	`/checkout/v3/cancellations`	POST	`order.invoice_number`, `payment.original_request_id`, `note`
Virtual Account	`/doku-virtual-account/v2/payment-code`	POST	`order.amount`, `order.invoice_number`, `virtual_account_info.billing_type`
QRIS (Jokul)	`/qris/v1/payment-code`	POST	`order.amount`, `order.invoice_number`, `qris_info.header_title`
QRIS (SNAP)	`/snap-adapter/b2b/v1.0/qr/qr-mpm-generate`	POST	`partnerReferenceNo`, `amount.value`, `merchantId`
E-Wallet	`/e-wallet/v1/payment`	POST	`order.amount`, `order.invoice_number`, `e_wallet_info.channel`
Credit Card	`/credit-card/v1/payment`	POST	`order.amount`, `card.token_id`, `card.three_ds`
Check Status	`/orders/v1/status/:invoice_number`	GET	`invoice_number` path param (returns `order.status` & `transaction.status`)
Online Refund	`/orders/v1/refund`	POST	`invoice_number`, `amount`, `reason`

<a name="bahasa-indonesia"></a>

Bahasa Indonesia

Deskripsi

Panduan ahli untuk mengintegrasikan DOKU Payment Gateway (Jokul API v2 & SNAP API v1.0) sesuai standar dokumentasi resmi DOKU Developers Portal. Mencakup header autentikasi, pembuatan Digest SHA-256, pembuatan Signature HMAC-SHA256 & HMAC-SHA512, verifikasi Webhook, Checkout Payment Link, Direct Payment (Virtual Account, QRIS, E-Wallet, Kartu Kredit, Direct Debit, PayLater, Refund), Check Status API, penanganan error, dan deployment Sandbox ke Production.

Kondisi Pemicu

Aktifkan skill ini ketika pengguna sedang:

Membangun atau merefaktor integrasi DOKU Payment Gateway di Node.js, TypeScript, Python, Go, PHP, atau Java.
Mengimplementasikan kalkulasi signature HMAC-SHA256/HMAC-SHA512 atau verifikasi signature notifikasi webhook.
Mengatur API Checkout, Virtual Account, QRIS, E-Wallet, Kartu Kredit, Direct Debit, PayLater, atau Refund.
Memeriksa status transaksi via /orders/v1/status/:invoice_number atau endpoint SNAP.

🚨 SNAP Integration Mandate (CRITICAL)

MANDATORY: The AI Agent MUST automatically apply the SNAP API v1.0 standard (Standard Nasional Open API Pembayaran) for all DOKU integrations, instead of the legacy Jokul API v2, unless the user explicitly requests otherwise. All generated signatures, headers, and endpoints MUST follow the SNAP BI standard.

🧪 DOKU Sandbox Simulator

MANDATORY: When testing in Sandbox mode and needing to access the Payment Simulator, the AI Agent MUST use this exact URL: https://sandbox.doku.com/integration/simulator/.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free