OVO

OVO offers 2 payment types, which are One-Time Payment and Recurring Payment. For both payment types, tokenization must be completed first before transactions can be executed.

Integration Steps

Overview of integration process with OVO.


1. Account Binding

Account Binding process should be done before payment can be made and processed. Merchant will send account binding request from customer to DOKU. The request includes customer's phone number that is registered to customer's OVO account.

Each OVO account can only be bind to one customer on one merchant. Customer needs to do verification for account binding process by inputting OTP and PIN.

Account Binding Flow

Account Binding Flow - OVO

API Endpoint

Environment
Endpoint

HTTP Method

POST

Path

.../direct-debit/core/v1/registration-account-binding

Sample of Request Header, Request Body and Response Body

Notes:

Parameter with (*) is mandatory

Paramater without (*) is optional/conditional

Account Binding

post
Header parameters
X-TIMESTAMPstring · utc timestampRequired

Client's current local time in yyyy-MM- ddTHH:mm:ssTZD format

Example: 2020-12-21T07:56:11.000Z
X-SIGNATUREstringRequired

Algorithm symmetric signature HMAC_SHA512 (clientSecret, stringToSign)

Example: 85be817c55b2c135157c7e89f52499bf0c25ad6eeebe04a986e8c862561b19a5
X-PARTNER-IDstringRequired

Unique ID for a partner (DOKU'S Client ID)

Example: 821508239190
X-EXTERNAL-IDstringRequired

Numeric String. Reference number that should be unique in the same day (request-id)

Example: 418075533589
AuthorizationstringRequired

Access Token obtained from Get B2B Token API

Example: 95221
Body
phoneNostringRequired

Phone Number Customer | Format: 628238748728423 | min length: 9 max length: 16 | Mandatory

Example: 628238748728423
Responses
chevron-right
200

Successful

application/json
post
/direct-debit/core/v1/registration-account-binding
200

Successful

2. Balance Inquiry

After customer has bind/linked their OVO account, customer can check their account balance infirmation using Balance Inquiry. Merchant will send balance inquiry request from customer to DOKU.

Merchant can also use balance inquiry API to check if customer has sufficient balance before invoking payment process.

Balance Inquiry Flow

Balance Inquiry Flow - OVO

API Endpoint

Environment
Endpoint

HTTP Method

POST

Path

.../direct-debit/core/v1/balance-inquiry

Sample of Request Header, Request Body and Response Body

Notes:

Parameter with (*) is mandatory

Paramater without (*) is optional/conditional

Balance Inquiry

post
Header parameters
X-TIMESTAMPstring · utc timestampRequired

Client's current local time in yyyy-MM- ddTHH:mm:ssTZD format

Example: 2020-12-21T07:56:11.000Z
X-SIGNATUREstringRequired

Algorithm symmetric signature HMAC_SHA512 (clientSecret, stringToSign)

Example: 85be817c55b2c135157c7e89f52499bf0c25ad6eeebe04a986e8c862561b19a5
X-PARTNER-IDstringRequired

Unique ID for a partner (DOKU'S Client ID)

Example: 821508239190
X-EXTERNAL-IDstringRequired

Numeric String. Reference number that should be unique in the same day (request-id)

Example: 418075533589
Authorization-customerstringRequired

Access token obtained from B2B2C API

Example: Bearer fa8sjjEj813Y9JGoqwOeOPWbnt4CUpvIJbU1mMU4a11MNDZ7Sg5u9a
AuthorizationstringRequired

Access Token obtained from Get B2B Token API

Example: Bearer eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE2OTgwNTA3NDMsImlzcyI6IkRPS1UiLCJjbGllbnRJZCI6IkJSTi0wMjExLTE2OTY5MTk2NTE5MTgifQ.x-D5VlK6TlVZbLPUSCr-Gbfgh4tnp0QDJmedYFHJGHFjg1c4x39pszU4sLvRhr0Jk0vKdMIzxUZeNhKoesWqDJitnG3kfrNZNsMb_WYUC0tJW91onXzYOKXiTgsHwRNFoWPQHlXIEtT3RQm-SRlCpk_E0gsavgkQn2-kbJEBnPhIs4eKg5IUY9GYi4hRr-_GHsudDl8sd2B5UBB_rHYq36BRmLXH7i7MQADHPsB1ktPVgk3ZWF0jebEjI-lJ88p-omL1vQNvRseXej2HKBa9chGLmPDvXYBQaRmmstHz-tv1boFrHfwsHJebcUec-i3WE1vMvP_3EPXdbqb45N4ciQ
Body
Responses
chevron-right
200

Successful

application/json
post
/direct-debit/core/v1/balance-inquiry
200

Successful

3. Payment

After customer's account is bind/linked and customer has enough balance for payment, merchant can send payment request from customer to DOKU.

One Time Payment

For One-Time Payments, each transaction must be verified by the customer by entering an OTP and PIN. To enable this flow, merchants are required to include the parameter paymentType: "SALE" in the payment request body.

In response, the merchant will receive a webRedirectUrl, which should be used to redirect the customer to complete the payment by entering their OTP and PIN. Once the payment process is completed, the merchant will receive a payment notification confirming the transaction status.

Recurring Payment

For OVO Recurring, payments are processed on a scheduled basis. Therefore, OTP and PIN verification is not required for every transaction. Customers only need to complete the verification once during the account binding process, which grants the merchant authorization to execute subsequent scheduled payments.

To initiate this flow, merchants are required to include the parameter paymentType: "RECURRING" in the payment request body. In this scheme, the merchant will not receive a webRedirectUrl, as no customer redirection is needed. The payment request will be processed directly by the acquirer, and the merchant will receive a notification with the transaction result.

Payment Flow

One Time Payment Flow - OVO

Recurring Payment Flow - OVO

API Endpoint

Environment
Endpoint

HTTP Method

POST

Path

.../direct-debit/core/v1/debit/payment-host-to-host

Sample of Request Header, Request Body and Response Body

Notes:

Parameter with (*) is mandatory

Paramater without (*) is optional/conditional

Payment

post
Header parameters
X-TIMESTAMPstring · utc timestampRequired

Client's current local time in yyyy-MM- ddTHH:mm:ssTZD format

Example: 2020-12-21T07:56:11.000Z
X-SIGNATUREstringRequired

Algorithm symmetric signature HMAC_SHA512 (clientSecret, stringToSign)

Example: 85be817c55b2c135157c7e89f52499bf0c25ad6eeebe04a986e8c862561b19a5
X-PARTNER-IDstringRequired

Unique ID for a partner (DOKU'S Client ID)

Example: 821508239190
X-EXTERNAL-IDstringRequired

Numeric String. Reference number that should be unique in the same day (request-id)

Example: 418075533589
Authorization-customerstringRequired

Access token obtained from B2B2C API

Example: Bearer fa8sjjEj813Y9JGoqwOeOPWbnt4CUpvIJbU1mMU4a11MNDZ7Sg5u9a
AuthorizationstringRequired

Access Token obtained from Get B2B Token API

Example: 95221
Body
partnerReferenceNostringRequired

Partner Reference No from partner | max: 64 | Mandatory

Example: INV-0001
feeTypestringOptional

Fee type from partner | value should be: OUR/BEN/SHA

Example: OUR
Responses
chevron-right
200

Successful

application/json
post
/direct-debit/core/v1/debit/payment-host-to-host
200

Successful

4. Payment Notification

After payment is completed, DOKU will send HTTP Notification to merchant's defined Notification URL.Learn how to handle the notification from DOKU.

5. Additional Feature

Online Refund

This endpoint is used to create refund request for previous successful payment. Merchant can request a transaction refund to DOKU.

Online Refund Flow

Online Refund Flow - OVO

API Endpoint

Environment
Endpoint

HTTP Method

POST

Path

.../direct-debit/core/v1/debit/refund

Sample of Request Header, Request Body and Response Body

Notes:

Parameter with (*) is mandatory

Paramater without (*) is optional/conditional

Refund

post
Header parameters
X-TIMESTAMPstring · utc timestampRequired

Client's current local time in yyyy-MM- ddTHH:mm:ssTZD format

Example: 2020-12-21T07:56:11.000Z
X-SIGNATUREstringRequired

Algorithm symmetric signature HMAC_SHA512 (clientSecret, stringToSign)

Example: 85be817c55b2c135157c7e89f52499bf0c25ad6eeebe04a986e8c862561b19a5
X-PARTNER-IDstringRequired

Unique ID for a partner (DOKU'S Client ID)

Example: 821508239190
X-EXTERNAL-IDstringRequired

Numeric String. Reference number that should be unique in the same day (request-id)

Example: 418075533589
AuthorizationstringRequired

Access Token obtained from Get B2B Token API

Example: 95221
Body
originalPartnerReferenceNostringRequired

Partner Reference No Purchase Transaction | max: 32 | Mandatory

Example: INV-0001
originalExternalIdstringOptional

External ID Purchase Transaction | max: 36 |

Example: REQ-0001
reasonstringOptional

Reason from customer | max: 255

Example: Request by Customer
partnerRefundNostringRequired

Partner Refund No| max: 64 | Mandatory

Example: INV-REF-0001
Responses
chevron-right
200

Successful

application/json
post
/direct-debit/core/v1/debit/refund
200

Successful

Account Unbinding

If a registered customer no longer wants their account/card to be bind/linked and wish to remove themself from DOKU's and merchant’s system, merchant can send account unbinding request that is initiated by customer.

Account Unbinding Flow

Account Unbinding Flow - OVO

API Endpoint

Environment
Endpoint

HTTP Method

POST

Path

.../direct-debit/core/v1/registration-account-unbinding

Sample of Request Header, Request Body and Response Body

Notes:

Parameter with (*) is mandatory

Paramater without (*) is optional/conditional

Account Unbinding

post
Header parameters
X-TIMESTAMPstring · utc timestampRequired

Client's current local time in yyyy-MM- ddTHH:mm:ssTZD format

Example: 2020-12-21T07:56:11.000Z
X-SIGNATUREstringRequired

Algorithm symmetric signature HMAC_SHA512 (clientSecret, stringToSign)

Example: 85be817c55b2c135157c7e89f52499bf0c25ad6eeebe04a986e8c862561b19a5
X-PARTNER-IDstringRequired

Unique ID for a partner (DOKU'S Client ID)

Example: 821508239190
X-EXTERNAL-IDstringRequired

Numeric String. Reference number that should be unique in the same day (request-id)

Example: 418075533589
AuthorizationstringRequired

Access Token obtained from Get B2B Token API

Example: 95221
Body
tokenIdstringOptional

format: Value from getTokenB2B2C | max: 2048 | Mandatory

Example: eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE2OTg4MjI3NTQsImlzcyI6IkRPS1UiLCJjbGllbnRJZCI6IkJSTi0wMjAyLTE2OTAyNzUzNTM3OTgiLCJhY2NvdW50SWQiOiJjZTBhZWIyM2YyMmZhOTgxZWViNTE1MjFmZmNkYmUzNyJ9.QZ2z0p2PoCYbuBSId7LleLqTUwNyNIeM1PUSaV4DwGKO05l7xQ3EbpdAPK62hxKNcczKqQqGY2Om6rzS78s2Tj88dkDD2vl46o3xEPd_plqQW8ayFqS74Z_HcFJfdo-egqFv9rAX7qgiE5AJHSx_hFolET9B3o3Jx82lmQutnXOjYb5gW9PV0FCPIZRWOaXppOSJSVcmTvXZxF0KUID9-2QVmQ5aPZroHjShYJKGyUu-1tCPClD_CbZMCi3TxhKLnI3e2oIoK7VjXEsrJjuil8O1zZTT7_aXAGgTu5UcPCrc0U9_3Nj-wQlEjDpedMVypKAWATWBUVpMo2MAsBRDAw
Responses
chevron-right
200

Successful

application/json
post
/direct-debit/core/v1/registration-account-unbinding
200

Successful

Last updated