{"info":{"_postman_id":"6afbef0d-6415-4ce9-a7e1-9f125b3457e6","name":"YUKKAPI - Authentication Service","description":"

Overview

\n

YUKKAPI - Authentication Service allows Partners / Clients who want to do integration with Yukk's External API Services. This authentication service can be used accross all listed collection as follows:

\n
    \n

  1. YUKKAPI - Wallet & Payment [link]

    \n
    2. \n

  2. YUKKAPI - YUKK Payment Gateway (H2H) [link]

    \n
    3. \n

  3. YUKKAPI - YUKK Payment Gateway (WEB) [link]

    \n
    4. \n

  4. YUKKAPI - QRIS Payment [link]

    \n
    5. \n

  5. YUKKAPI - Merchant Registration [link]

    \n
    6. \n
\n

Getting Started

\n

In order to use this API collection, you need to do the following:

\n
    \n

  1. Have your company information registered in our system by our Account Manager

    \n
    2. \n

  2. Get client credentials (client_id & client_secret) from our Account Manager

    \n
    3. \n

  3. Use the client credentials on API Get Access Token (B2B) to acquire B2B accessToken

    \n
    4. \n
\n

The B2B token then can be used to access all Yukk API collections.

\n

Yukk Services & Channel ID

\n

Listed below is the constant value of CHANNEL-ID used in the Request Header across all Yukk API collections

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Service NameCHANNEL-ID
QRIS Payment00001
Yukk Wallet & Payment00002
Yukk Payment Gateway00003
Yukk Money Transfer00004
\n

Headers

\n

Request Header for Authentication

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldAttribute (MOC)TypeDescription
Content-TypeMStringMedia type of the resource (e.g: application/json)
X-TIMESTAMPMStringClient’s current local time
yyyy-MM-ddTHH:mm:ssTZD
X-CLIENT-KEYMStringclient_id
X-SIGNATUREMStringAsymmetric signature algorithm SHA256withRSA (Private_Key, stringToSign). stringToSign = client_ID + “l” + X-TIMESTAMP
\n

Request Header for API

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldAttribute (MOC)TypeDescription
Content-TypeMStringMedia type of the resource (e.g: application/json)
AuthorizationMStringRepresent access token of a request

Value: {{accessTokenType}} {{access_token}} of a request E.g: “Bearer {{access_token}}”
Authorization-CustomerMStringRepresent access token of a request belong to customer

Value: {{accessTokenType}} {{access_token}} of a request E.g: “Bearer {{access_token}}”
X-TIMESTAMPMStringClient’s current local time
yyyy-MM-ddTHH:mm:ssTZD
X-SIGNATUREMStringX-Signature : algoritma symmetric signature HMAC_SHA512 (clientSecret, stringToSign) with formula

HMAC_SHA512 (clientSecret, stringToSign) with formula stringToSign = HTTPMethod +”:“+ EndpointUrl +\":\"+ AccessToken +\":“+ Lowercase(HexEncode(SHA256(minify(RequestBody))))+ \":“ + TimeStamp
X-PARTNER-IDMString (36)Partner unique ID
X-EXTERNAL-IDMString (36)Unique reference number in numeric string
X-DEVICE-IDMString (400)Customer’s device identification
E.g:

Web Application:
- Mozilla / 5.0(Windows NT 10.0; Win64; x64)AppleWebKit / 537.36(KHTML, like Gecko)Chrome / 75.0.3770.100 Safari / 537.36 OPR / 62.0.3331.99

Mobile Application:
- Android: android-20013adf6cdd8123f
- iOS: 72635bdfd223yvjm7246nsdj34hd4559393kjh42
CHANNEL-IDMString (5)See Yukk Services & Channel ID
User-AgentMString (150)User agent
\n

Response Code

\n

Response code = HTTP Status Code + Service Code + Case Code

\n

E.g:

\n

For successful response of API Balance Inquiry (Service Code = 11):

\n\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Cat.HTTP Status CodeCase CodeResponse Message
Success20000Successful
System40000Bad Request
Message40001Invalid Field Format {{field name}}
Message40002Invalid Mandatory Field {{field name}}
System40100Unauthorized. {{reason}}
System40101Invalid Token
System40102Invalid Customer Token
System40103Token Not Found
System40104Customer Token Not Found
Business40300Transaction Expired
System40301Feature Not Allowed. {{reason}}
Business40302Exceeds Transaction Amount Limit
Business40314Insufficient Funds
Business40400Invalid Transaction Status
Business40401Transaction Not Found
Business40404Transaction Canceled
Business40413Invalid Amount
Business40414Paid Bill
Business40416Partner Not Found
System40900Conflict
System40901Duplicate partnerReferenceNo
System42900Too Many Requests
System50000General Error
System50001Internal Server Error
System50002External Server Error
System50400Timeout
\n

Domain (Base URL)

\n\n

SNAP Signature

\n

Asymmetric in B2B Access Token (SHA256withRSA)

\n

The following steps will explain about Asymmetric without Access Token (SHA256withRSA).

\n

1. Asymmetric Key Generation

\n

The below will explain about asymmetric key generation:

\n

a. Create Private Key

\n
openssl genrsa -out rsa_private_key.pem 2048\n\n

b. Export Public Key

\n
openssl rsa -in rsa_private_key.pem -out rsa_public_key.pem -pubout \n\n

Partner should generate the signature with rsa_private_key.pem and YUKK will use rsa_public_key.pem to validate the signature and vice versa.

\n

2. Digital Signature Generation

\n

The below are steps of digital signature generation:

\n

a. Compose the string to sign:

\n\n
SHA256withRSA (Private_Key, stringToSign).with formula stringToSign = client_ID + “|” \n+ XTIMESTAMP \n\n

b. The signature string is generated from string to sign above with applying SHA-256 with RSA-2048 encryption using pkcs8 private key, and then encode the result to base64.

\n

c. Put the signature string into HTTP header “X-SIGNATURE“ when call API for applying B2B access token.

\n

Example:

\n
● stringToSign = client_ID + “|” + XTIMESTAMP\n9JYVuBkHmPSuMAJRmpN2|2022-10-06T15:08:00+07:00\n● Private_Key\n-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA2pjFs43FkA9/s3kGNYquRqq/QyV9Iscwp1uKiI2qLUzI4FAd\nBoHx2+pdVTWkOxvqpxUBzYo2joaFA7VQqyjUwSzFnYTIdRnmU/59cuf/xHDc8OsP\nNL8DvXlFj0B9mX253P+LBxWCeM+q1nXKo6xmIK6JYNKSIlyGhhSwHVQMdGE+TYAI\nKeVuvvrbsj8rcZxlPSch0GfNO+q/eB5qqmBnmiks3IMu020pj4830G7Y9ksX7JJs\nY3H55VUA9Hlw0MazuLudo/G3+xAxpaIZoFyuCwJDm5VCNtpLUESJIJlGeXxchJ3R\nsBBOpRgdKy+1dtjlj6MKk+Q0qmh6/e8MkgJdCwIDAQABAoIBAQDCNg0gM4sdLMf2\nOkYr96RSoI0BKSN+bJ5rckcof0R8rsWhlUvUZkrtadG2TMw2v9zAyUcqx+skwZsX\n6lVbXBF59z8zba9zaqlaYrYuCrUQYH3LheuinzrBcic82L0+S5eAI4Hvr0qV71sG\n4uxAcoDh9G+VmD/BS5cxNNwrkmrmUYLaOmaR56AsKXLbG37PeJZpnIPEl/VAuDK5\nWw/cibT1DVY2HKM3AW3zPIGlY7MlJRcV5ztu6d8iUwA61Yy8XeamUhyRzkKvi5Y8\nScvpgIQrysFHl3O3aZciJivlLPLIprdJI+HvJYOz+NTa+2IoRJhBvHva7G0zNwj5\njI+eOtWhAoGBAO9mojwmmSNCLaQ3et6I1sb+XC77Es2dVy1kX0RfuDwqZ73SlLg1\nTjVVEJlcyU+wqth+G8OTYkRm0O2W1bm5CyFsJZlBMpndNjGnqtLlrjDOjM1rL6tJ\n2I8um1OI3m2e3W9oEQdEk5sF7h0oPkW0C7XUj98ikVNLOEunhx+sUmhpAoGBAOnA\n3WyRnfnH6DUumzWnzPzKS3T4OaJmAKv79jC/p2ppNkqcSKjPv2JM5aM8W2o6U1Ti\nAaHLhu26BQ29II5PRL4rBv+lgHaLCXwgwI33jk6c1F9BKZiDey1UPkPHeVHF0Wix\nifRcB+euMsNq4086KKS7tqpt/WZhlnfPPK74ngtTAoGASD1wNzZuf3U40JTtPrmM\nFgArUQHyaplP9SKUnM1FiuJA68bfmbZ8IxvIJn8ZQDLPWwSy3BFdVcawxQD+/UwZ\nT7ySm+xQmJ1n/RPbOEiWh6PMWTA+8jEWaB5oQIzMkceeij+c49SNtfnUIHhEUkRC\nRFwgDfUgZUINesbSv3wAYgECgYEAzBMVPTPkN63PjJ6j4rQcwpXaSsRrjNyAuaW/\nyc+I2d4BCCJpTPgSnj+EPH71UEibd//YbOjDY8iDoPr88UFDQsNN2OMkxFmebkAp\n28fE9dz1jDPXnM8tOuXRdlswD7QknsJhLnUqcZojt3gZ+5FK6ob3ctOT505Lj03e\nLOPhFwECgYAZpLsKFxyPgzncYT4s5fB6Pa35EWc4LSKxUE7hc+Tq156bxz5fNcb3\naZ5Qqn88MCfAEJPzKjM874fTVu3DSdUwYpxFc6xgpBpbqoK7+Qj5HY/HH60R8eg1\n0NWybzUZolpzusBSJ3QxTY6Isbrpyp8QwziIaHPJBaI+UMwyxOjTnw==\n-----END RSA PRIVATE KEY-----\n\n

Result :

\n
RUTGZ+FobSdHjoXKEpOA+YTFNUOX2WKQ2JNWQCA2evw5cy6tQ7eBLIbx4u9aycReXmsAKTY8op0MsIO6ZAMpW7Dg\nYuy1dLmvZg+gkNt9myYqzaGPWf/LmG8epIxkOJA3IHi7CVPzQrH/2Aq2Ez5tyPIQAmNC//sOGL6CJLOrSGL24g7Vr\nFgkXDcPsOD28FESBTPURRftgY3K4bZLF5QotVq937TO6Rks/2bFnfhBljuOf3bZu1Xw0SuNZK2FTj1txduCHnnfZR\nnZMTs0D4Y4bWhZI35oN6xfDZN61VZFP0ZvixTebwaB6d/nXlt9qohK8OZqmw41HvzQHydpBHZq8g==\n\n

3. Symmetric in API services (HMAC_SHA512)

\n

The following steps will explain about Symmetric with Access Token (HMAC_SHA512).

\n
Digital Signature Generation
\n

The below are steps of digital signature generation:

\n

a. Compose the string to sign:

\n\n
HMAC_SHA512 (clientSecret,stringToSign) with formula stringToSign = HTTPMethod\n +”:“+ EndpointUrl +\":\"+ AccessToken+\":“+ Lowercase(HexEncode(SHA256(minify\n(RequestBody))))+ \":“ +TimeStamp\n\n

b. The signature string is generated from string to sign above with applying HMAC_SHA512
hashing using client secret key which given by YUKK, and then encode the result to base64.

\n

c. Put the signature string into HTTP header “X-SIGNATURE“ when call YUKK API.

\n

d. For EndpointUrl

\n

Example:

\n
clientSecret\nC7BR6aXzp5XjJT0UQD7FTPJtU94C5QsVpfCBElCY\nstringToSign\nPOST:/payment-gateway/openapi/v1.0/transfer-va/create-va:eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiIxIiwi\nanRpIjoiNGEzMjgwODZjZmQ5NWVlYTU4MmI4NWI3MDEwMTA4ZmZhMjg2MjgyMzgxMTh\nhYzNhMmE5ZjRlZmI0MmJkMzk4MjYwYzk4MTUxNjE0NTFkMmIiLCJpYXQiOjE2NjUwNDM4\nMjAuMzY0MjY1LCJuYmYiOjE2NjUwNDM4MjAuMzY0MjcyLCJleHAiOjE2NjUwNDQ3MjAuM\nzQxMDcyLCJzdWIiOiIxNiIsInNjb3BlcyI6W119.iZ9CShOTvz2-oPLjxM93vPLceauetLFFwYbgG4\n2tnpqHON8v_1y1wKQDr_MZWZB66rMLRMmzVqo6vl1iyW77JZk10U-quFYQOz4kW5w7tvc\n5zla8H2VeSKIkCgz_bVESMHZsHffms36bge7ZXhI3FEHG6Powq7HvSHo2ocr0ub_V1G0opX81\nQMs1-9aGEpnqT_5DFihy4fVdgBts2tQX9hgDfWBu7ooAvdgNFu75mFd6CAlC3rI9xSvmkpuH\ns2uqVVSwGaJY4gLiz4Y3M7eRK83nZ6OEKyIY80wG0-NP-G008mMmLxt8-ujsjPEGTL8t874fw\nxhIJaH6ti3e8_V5_IJy_yx4DfzV8HqW8FHvyFKdzI-UFtmuGSoLJzQoMjlG7q5GXvaVgrIaXveVO\nwHk4GTnKL6vVUQvXZtpI0U1duv2JdtGSC9znhuu5K1byyqamJRYntxUw-DXdXVeDSaenPn0N\ncF-CGdibyAZPdPqIon7aLdCjee1eCaWtPCANGNQPc3J2R6bJuYgq2uTJyagKMhH6iw-s3E95AJ\nLGaZCnH1FXf69mgQysnHC6YFhFLIvK8mMMgtbDEXRe1vDYKo0GlYjNy_8232Gbxf_PxFWnw\nPG89tpmUf4Rbjx4fOt8I_OmV57EllnjsR_U4QzaR9VLFv2jefTPQp_dDSp-dxzJ5A:e1dcc500b1\n4795d030f48f0667db6592a2c0f43115810d90a7e793500d549edf:2022-10-06T14:57:00+0\n7:00\n\n

Result:

\n
mzgO0XP9qRCPG+g+AzD3Ge7UkKxsnEgM3WGTZ5FKjVAipXWSdhDXIRSaONdaYlwuSx9VkX\nmuuHbpYTX87bKPjQ==\n\n
","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[],"owner":"23209878","collectionId":"6afbef0d-6415-4ce9-a7e1-9f125b3457e6","publishedId":"2sA3XTfg79","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"publishDate":"2026-07-20T05:16:59.000Z"},"item":[{"name":"Get Access Token (B2B)","event":[{"listen":"prerequest","script":{"id":"3674e4e8-5b25-4bec-a52b-e6511babea44","exec":[""],"type":"text/javascript","packages":{}}},{"listen":"test","script":{"id":"5c585bfb-996f-46f0-9b46-341835adeb23","exec":["const json = pm.response.json();\r","\r","if (pm.response.code == 200) {\r"," pm.environment.set('access_token_b2b', json.accessToken)\r","}"],"type":"text/javascript","packages":{}}}],"id":"b355572f-cd31-4805-aeae-8a8c9a9c9ba5","protocolProfileBehavior":{"disabledSystemHeaders":{},"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"POST","header":[{"key":"X-TIMESTAMP","value":"2024-03-07T09:45:00Z"},{"key":"X-SIGNATURE","value":"eiticveiOQn3dbuXFvYNuGkRs/2D/rQ0wrANM/i6QmYF24c9kU1TYiKcgH1e9D3MVgd1ll2wtBSmyLugOG6gaAw5hAKAcLq8VrLGYMOQAcfMPk1Hc+gxyYhdWKR19mt0CkUr9JLNXhm/SbeuZEpBgte0VKOdMSLxIbKOyBhVOqLZ5wOLBvAyNjV9OQ1KVj5blXQYHGdC47HmqDZdqtf3FOaF40kuXOsmzER8HSw4HQXmIjsJLZwe588vKQi9UKkIBbu9ynyYbV3ULcrsHSGoRMsZzWsClEfmI/Z62tFMMKJwtlm60x8bAeUfkuI6OTPR7GemXbAtb2HMdOeQBu4ayQ=="},{"key":"X-CLIENT-KEY","value":"{{client_id}}"},{"key":"Content-Type","value":"application/json"},{"key":"User-Agent","value":"insomnia/8.5.1"}],"body":{"mode":"raw","raw":"{\r\n \"grantType\": \"client_credentials\"\r\n}","options":{"raw":{"language":"json"}}},"url":"{{base_url}}/{{extend_url_auth}}/openapi/v1.0/access-token/b2b","description":"

Description

\n

Use this API to obtain B2B accessToken, which should be included in all headers of Wallet & Payment API Collection.

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Service code73
API NameAPI Access Token B2B
Version1.0
HTTP MethodPOST
Path../{version}/access-token/b2b
\n
Request Body
\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldAttribute (MOC)TypeDescription
grantTypeMString“client_credentials”
\n
","urlObject":{"path":["{{extend_url_auth}}","openapi","v1.0","access-token","b2b"],"host":["{{base_url}}"],"query":[],"variable":[]}},"response":[{"id":"b7e715a0-0f33-4ff1-ba6d-4b0664a1cc6f","name":"Successful","originalRequest":{"method":"POST","header":[{"key":"X-TIMESTAMP","value":"2024-03-07T09:45:00Z"},{"key":"X-SIGNATURE","value":"{{serviceSignature}}"},{"key":"X-CLIENT-KEY","value":""},{"key":"User-Agent","value":"insomnia/8.5.1"}],"body":{"mode":"raw","raw":"{\r\n \"grantType\": \"client_credentials\"\r\n}","options":{"raw":{"language":"json"}}},"url":"{{base_url}}/{{extend_url_auth}}/openapi/v1.0/access-token/b2b"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json","description":""},{"key":"X-TIMESTAMP","value":"2024-03-07T09:45:00Z","description":""},{"key":"X-CLIENT-KEY","value":"015bf836-d6ac-4f5e-a745-a891b95edb48","description":""}],"cookie":[],"responseTime":null,"body":"{\n \"responseCode\": \"2007300\",\n \"responseMessage\": \"Successful\",\n \"accessToken\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiIzIiwianRpIjoiNWIyMjQ0NTI1MTVjZDc0OWYxYWZjZDFjNGEyMjA0MWE3Yzk3ZGNhNGE3ODNjYjUyYTNiYjlhOWQ2MzI1OWUxMTIxNGNiMWMwOGQzNzNmMTYiLCJpYXQiOjE3MDk2OTgzMzkuNDE0MTAxLCJuYmYiOjE3MDk2OTgzMzkuNDE0MTAzLCJleHAiOjE3MDk5MTQzMzguNjU5NzU3LCJzdWIiOiIiLCJzY29wZXMiOltdfQ.FZ1o-zyhd8ep6hSQFNVpqt70QKZcZv4XWstYbsomf2v6gVj7LllMUH4fa_bHxonj8kM1qUqIougA-9SKRlwOT2ZUugtK2-PyMM_MxrxXSpd-8YMfcxZOQ6GnnCalueuXad_gpOn_o2D73YIqdRNisjkMKt3pQfbqnfhwRAk84s_aZNsbOmfzB7tgMoZ3zSll4v-uWr9JbT_eOF-KWedGOegmdvGVKWvYwtq1P7VFT0D7iI0eN-tUWLeaFfRZfN7MDFFgEpHsZDaDupezoadbLGmCJ9dTO6Rkt-Pnwjw0qQB5AHiCTyF73C9qKxKP-CrJfG_x35dEco4B97AU_CQDJYTxedXYom0AwdONAz-U0sNTRhoCIlQjVR1gNovmn5oCjxkQnKZGPtZORRCkCfjaTDYOpt1Mb9UYqbM-RdRm_4tgWP7A2zLdp-TsWu2JTV-A6KGD6nC9ptreDs_tqKUi6-nU94o-n62G904yw2zKA0yn9p_cJDFsgrkU9ueJHYHrxWIIk-YUnLIyN5gb0qC6PiotZOpz6MPrXW53oE5Ee2CgpJ8D89wIf0fvjGB2XhAboLDkic3nxaPE7zurEgwwert4KUij0zN0484e5UXJO9J1eXAhFBkbaqrPtVa9kTm8OvQz5KC_PBZBR76_4BGuB10bJ7PhROXEtTYvKrUcoyI\",\n \"tokenType\": \"Bearer\",\n \"expiresIn\": 900\n}"}],"_postman_id":"b355572f-cd31-4805-aeae-8a8c9a9c9ba5"}]}