Midtrans Indonesia Payment Gateway API
Midtrans Indonesia payment gateway REST API for merchants selling in Indonesia and Southeast Asia to accept credit cards, bank transfers (VA), e-wallets (GoPay, OVO, ShopeePay), QRIS, and convenience store payments with fraud detection and subscription billing. Enables AI agents to manage payment transaction and charge creation for Indonesia e-commerce automation, handle virtual account (VA) bank transfer for Indonesia bank payment automation, access GoPay and digital wallet integration for Southeast Asia wallet automation, retrieve QRIS QR code payment for national payment standard automation, manage convenience store payment (Indomaret, Alfamart) for cash payment automation, handle subscription and recurring billing for Indonesia subscription automation, access fraud scoring and risk management for Indonesia payment security automation, retrieve settlement and reconciliation reporting for financial automation, manage refund processing for order management automation, and integrate Midtrans with WooCommerce, Shopify, and Indonesia business systems for end-to-end Indonesia/SEA payment automation.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Indonesia payments. PCI-DSS. API key. ID. Payment and transaction data.
⚡ Reliability
Best When
A merchant selling in Indonesia or Southeast Asia wanting AI agents to automate GoPay wallet, virtual account bank transfer, QRIS, and convenience store payment acceptance through Midtrans' Gojek-backed Indonesia payment gateway.
Avoid When
PAYMENT METHOD AVAILABILITY VARIES BY MERCHANT ACTIVATION: Midtrans payment methods (GoPay, specific VA banks, convenience stores) require separate merchant activation for each method; automated checkout must verify active payment methods before presenting to customer; automated payment method display without activation check shows payment options not available for merchant account. VIRTUAL ACCOUNT BANK LIST IS CONFIGURABLE: Midtrans VA bank transfer supports multiple Indonesian banks (BCA, Mandiri, BNI, BRI, Permata); each VA bank requires separate activation; automated VA checkout must filter to activated VA banks only; automated display of all VA banks without activation check creates unavailable payment option for customer. QRIS PAYMENT EXPIRY AND STATUS POLLING: QRIS payments expire (typically 15 minutes); automated QRIS payment flow must communicate expiry and implement status polling; automated QRIS without expiry tracking creates pending payment lingering beyond customer willingness to pay.
Use Cases
- • Accepting Indonesian e-wallet payments from SEA digital payment agents
- • Processing virtual account bank transfers from Indonesia billing agents
- • Generating QRIS codes from national payment standard agents
- • Managing convenience store payments from cash payment agents
Not For
- • Global payment processing outside SEA (use Stripe or Adyen for global)
- • Cross-border settlement to global accounts (use Wise or Airwallex for global treasury)
- • Enterprise global payment orchestration (use Adyen for multi-national enterprise)
Interface
Authentication
Midtrans uses Server Key and Client Key for authentication (Base64-encoded in Authorization header). REST API with JSON. Jakarta, Indonesia HQ. Founded 2012 by Matthew Tillman and Ryu Suliawan. Acquired by Gojek in 2017. Products: Credit cards, virtual accounts, e-wallets, QRIS, convenience stores, recurring billing. SDKs: PHP, Python, Node.js, Java, Ruby, Go. PCI DSS. Serves 100,000+ merchants in Indonesia. Competes with Xendit, DOKU, and iPaymu for Indonesia payments.
Pricing
Jakarta ID. Gojek subsidiary. No monthly fee. Per-transaction fees in IDR. QRIS at regulated 0.7%.
Agent Metadata
Known Gotchas
- ⚠ SERVER KEY vs CLIENT KEY USAGE: Midtrans Server Key (for server-to-server) and Client Key (for client-side Snap.js) must be used in correct context; automated server-side Client Key usage creates unauthorized access; automated client-side Server Key exposure creates credential security vulnerability
- ⚠ SNAP TOKEN vs DIRECT CHARGE API: Midtrans supports Snap (hosted payment page via token) and Core API (direct charge integration); automated integration must select appropriate flow; automated Snap token for API-driven checkout creates redirect-based flow instead of direct API response; automated Core API for hosted checkout creates integration complexity for simpler use cases
- ⚠ WEBHOOK SIGNATURE VERIFICATION REQUIRED: Midtrans payment notifications include signature hash (SHA512 of order_id + status_code + gross_amount + ServerKey); automated notification processing must verify signature; unverified webhook creates security risk from spoofed payment confirmation
- ⚠ ORDER ID UNIQUENESS REQUIREMENT: Midtrans requires unique order_id per transaction; automated payment retry must generate new order_id; automated duplicate order_id creates transaction rejection
- ⚠ PAYMENT METHOD EXPIRY VARIATION: Different Midtrans payment methods have different expiry windows (QRIS: 15 min, VA: 24-72 hours, convenience store: 24-72 hours); automated checkout must communicate correct expiry per payment method; automated uniform expiry message creates incorrect customer expectation for longer-expiry payment methods
Alternatives
Full Evaluation Report
Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for Midtrans Indonesia Payment Gateway API.
AI-powered analysis · PDF + markdown · Delivered within 30 minutes
Package Brief
Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.
Delivered within 10 minutes
Score Monitoring
Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.
Continuous monitoring
Scores are editorial opinions as of 2026-03-07.