Incognito Payments

What is Incognito Payments?

Incognito Payments is a payment gateway for Indonesian bank transfers. You create a transaction through the API; we give you back an exact rupiah amount (your price plus a small unique code, e.g. Rp 150.076). When that exact amount lands in the BCA account, we confirm it automatically and send your server a signed callback — no manual checking, no per-account bank login on your side.

The API, signatures, and callbacks are Tripay-compatible, so if you have integrated Tripay before, this will feel familiar. If you use one of our SDKs, you can be live in a few minutes.

One payment channel, zero fees

A single BCA bank-transfer channel. No per-transaction admin fee is added — the customer pays exactly the unique amount.

Signed, retried webhooks

Every paid transaction triggers an HMAC-signed payment_status callback, retried with backoff until your server acknowledges it.

Sandbox you can pay

A full sandbox with a fake BCA. Call simulate-pay to settle a test transaction end to end and receive the real callback.

Node & PHP/Laravel SDKs

Official SDKs handle signing, requests, and callback verification. Install privately from your GitHub organisation.

Start here

Quickstart Keys → signed create → simulate payment → verify the callback, in one page.

Authentication API keys, Bearer auth, and how the sandbox and production environments are chosen.

Signatures How request and callback signatures are computed and verified.

API Reference Every endpoint, request field, and response field.

The payment flow at a glance

1. Create a transaction with your order reference and amount. We return a reference, the exact pay_amount (with its 3-digit pay_code), and a hosted checkout_url.
2. Send the customer to pay — either show them the bank account and exact amount yourself, or redirect them to the hosted checkout_url.
3. The customer transfers the exact amount from any bank to the BCA account.
4. We confirm it automatically by matching the exact amount in the BCA mutasi, mark the transaction PAID, and POST a signed callback to your server.
5. You fulfil the order after verifying the callback signature and replying {"success": true}.

Base URL

All API requests go to https://payment.incognito.asia/api/v1. The environment (sandbox vs production) is decided by which API key you authenticate with — not by the URL.