Create pay-in order

POST/pay-in/createTry it in Swagger →

Sandbox https://test.lintaspay.xyz/pay-in/create · Production https://lintaspay.xyz/pay-in/create

Creates a collection order and returns the payCode (VA number, QRIS string or payment URL) the payer uses. The result is delivered to your notifyUrl when the order succeeds or fails.

Request

Headers

Header	Required	Value
`Content-Type`	required	`application/json`
`Authorization`	required	`LINTASPAY-SHA256withRSA app_id=…,nonce=…,timestamp=…,sign=…` — see Signing requests
`lintaspay-request-id`	required	Unique request id, `[A-Za-z0-9_-]`, max 64

Body parameters

Name	Type	Required	Description
`productCode`	integer	required	Payment product. See Appendix → Pay-in product codes (e.g. 11 = BNI VA, 31 = QRIS, 41 = DANA). Example: `11`
`currency`	string	required	Currency. Only `IDR`. Example: `IDR`
`amount`	string	required	Amount in IDR, integer string. Minimum 10000. Example: `10000`
`mchOrderNo`	string	required	Your unique order number, max 64 chars. Unique per merchant; reusable only if the order was rejected. Max length 64. Example: `M202610140001`
`remark`	string	required	Remark in English, max 255 chars. Max length 255. Example: `Order 1001`
`userName`	string	required	Payer name: letters, digits, spaces, hyphens; max 255. For DANA (41) this must be the payer's phone number. Max length 255. Example: `Budi Santoso`
`notifyUrl`	string	optional	Your callback URL (max 255). Falls back to the default notify URL configured for your merchant account. Max length 255. Example: `https://merchant.example.com/notify/payin`
`expireTime`	string	optional	Seconds until the order expires. QRIS max 1800; VA default 3600; convenience store max 86400. Example: `3600`
`userPhone`	string	optional	Payer phone, digits only, max 20. Example: `081234567890`
`userEmail`	string	optional	Payer email. Example: `budi@example.com`
`payReturnUrl`	string	optional	Where to send the payer after paying (DANA), max 255. Example: `https://merchant.example.com/paid`

Example

{
  "productCode": 11,
  "currency": "IDR",
  "amount": "10000",
  "mchOrderNo": "M202610140001",
  "remark": "Order 1001",
  "userName": "Budi Santoso",
  "notifyUrl": "https://merchant.example.com/notify/payin",
  "expireTime": "3600",
  "userPhone": "081234567890",
  "userEmail": "budi@example.com"
}

Response

HTTP 200 with the envelope {"code", "message", "data"}. code = 0 means success; otherwise data is null and code is an error code. Authentication failures return HTTP 401 (403 for a blocked IP, 429 when rate-limited). Always verify the response signature.

`data` fields

Name	Type	Description
`merchantId`	integer	Your merchant id. Example: `100001`
`merchantOrderNo`	string	Your order number. Example: `M202610140001`
`orderNo`	string	LintasPay order number. Example: `LPIN2026101410300512AB34CD56EF`
`payCode`	string	What the payer uses to pay: VA number, QRIS string, or payment URL (DANA). Example: `8808123456789012`
`amount`	string	Order amount. Example: `10000`
`orderFee`	string	Fee charged for this order (2 decimals). Example: `4500.00`
`expireAt`	string	Expiry time (GMT+7). Example: `2026-10-14T11:30:05+07:00`

Examples

{
  "code": 0,
  "message": "success",
  "data": {
    "merchantId": 100001,
    "merchantOrderNo": "M202610140001",
    "orderNo": "LPIN2026101410300512AB34CD56EF",
    "payCode": "8808123456789012",
    "amount": "10000",
    "orderFee": "4500.00",
    "expireAt": "2026-10-14T11:30:05+07:00"
  }
}

{
  "code": 10011304,
  "message": "Signature verification failed",
  "data": null
}

Code samples

URL_PATH=/pay-in/create
BODY='{"productCode":11,"currency":"IDR","amount":"10000","mchOrderNo":"M202610140001","remark":"Order 1001","userName":"Budi Santoso","notifyUrl":"https://merchant.example.com/notify/payin","expireTime":"3600","userPhone":"081234567890","userEmail":"budi@example.com"}'
AUTH="app_id=$APP_ID,nonce=$(openssl rand -hex 16),timestamp=$(date +%s)000"
SIGN=$(printf '%s\nPOST\n%s\n%s\n' "$AUTH" "$URL_PATH" "$BODY" \
  | openssl dgst -sha256 -sign merchant_private_key.pem | base64 | tr -d '\n')

curl -sS -X POST "https://test.lintaspay.xyz$URL_PATH" \
  -H 'Content-Type: application/json' \
  -H "Authorization: LINTASPAY-SHA256withRSA $AUTH,sign=$SIGN" \
  -H "lintaspay-request-id: $(openssl rand -hex 16)" \
  -d "$BODY"

// call() is defined on the Signing requests page
const res = await call('/pay-in/create', {
  "productCode": 11,
  "currency": "IDR",
  "amount": "10000",
  "mchOrderNo": "M202610140001",
  "remark": "Order 1001",
  "userName": "Budi Santoso",
  "notifyUrl": "https://merchant.example.com/notify/payin",
  "expireTime": "3600",
  "userPhone": "081234567890",
  "userEmail": "budi@example.com"
});
if (res.code !== 0) throw new Error(`${res.code} ${res.message}`);
console.log(res.data);

# call() is defined on the Signing requests page
res = call("/pay-in/create", {
  "productCode": 11,
  "currency": "IDR",
  "amount": "10000",
  "mchOrderNo": "M202610140001",
  "remark": "Order 1001",
  "userName": "Budi Santoso",
  "notifyUrl": "https://merchant.example.com/notify/payin",
  "expireTime": "3600",
  "userPhone": "081234567890",
  "userEmail": "budi@example.com"
})
if res["code"] != 0:
    raise RuntimeError(f"{res['code']} {res['message']}")
print(res["data"])

<?php
// api_call() is defined on the Signing requests page
$res = api_call('/pay-in/create', json_decode('{"productCode":11,"currency":"IDR","amount":"10000","mchOrderNo":"M202610140001","remark":"Order 1001","userName":"Budi Santoso","notifyUrl":"https://merchant.example.com/notify/payin","expireTime":"3600","userPhone":"081234567890","userEmail":"budi@example.com"}', true));
if ($res['code'] !== 0) {
    throw new RuntimeException($res['code'] . ' ' . $res['message']);
}
print_r($res['data']);

// ApiClient is defined on the Signing requests page
ApiClient client = new ApiClient();
String body = "{\"productCode\":11,\"currency\":\"IDR\",\"amount\":\"10000\",\"mchOrderNo\":\"M202610140001\",\"remark\":\"Order 1001\",\"userName\":\"Budi Santoso\",\"notifyUrl\":\"https://merchant.example.com/notify/payin\",\"expireTime\":\"3600\",\"userPhone\":\"081234567890\",\"userEmail\":\"budi@example.com\"}";
String res = client.call("/pay-in/create", body);
System.out.println(res);