Ayoconnect's Scheduler API provides a seamless way to accept payments by binding your customer's bank account (enabling recurring payments). ## Product Features

Securely link your customer's bank account
Supports both one-time checkout and recurring payments
Pull funds directly from your customer's bank account with their consent
Unlink your customer's bank account directly from the application
Robust Alert systems to detect anomalies
Automated Reconciliation
Dashboard for transaction visibility

You can download the full Product Guide from here. ## Supported Banks | Bank Name | Bank Code | Support Split Settlement | Support Payment With OTP (API Based) | Support Payment Without OTP (API Based) | Payment Only Using UI | Support Unbinding Without OTP (API Based) | |--------------|-----------|--------------------------------------|--------------------------------------|-----------------------------------------|-----------------------|-------------------------------------------| | Bank BRI | 002 |

| | Bank CIMB | 022 |

| | Bank Mandiri | 008 |

| | Bank BNI | 009 |

| | Bank BNC | 490 |

| | Bank Danamon | 011 |

| | Bank BCA | 014 |

| ## Credentials Before starting Direct Debit SNAP APIs integration, partners must ensure that they have all the required credentials. Every partner will receive a unique set of credentials from Ayoconnect during their onboarding process. | Credential | Description | Source | |---------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------| | merchantId | This field is a 6-character merchant identifier that is unique per each merchant. The exact value is disclosed to each merchant separately. | Provided by Ayoconnect. | | client_id | Unique 32-character string used to generate B2B and B2B2C Tokens. | Provided by Ayoconnect. | | client_secret | Unique 32-character string used to generate a signature. | Provided by Ayoconnect. | | Public Key | RSA Public key. The method to generate a valid key pair is mentioned below. The public key needs to be shared by the partner during their onboarding process. | Generated by the partner. | | Private Key | RSA Private key. The method to generate a valid key pair is mentioned below. | Generated by the partner. |

RSA Key Pair Generation

Generate a private key with the correct length.
- openssl genrsa -out private-key.pem 3072
Generate the corresponding public key.
- openssl rsa -in private-key.pem -pubout -out public-key.pem

Authentication

All API requests must contain the Authorization Token in the header, which is used to authenticate the merchant.
There are two types of Authorization Tokens:

B2B Token

Generated Using Generate B2B Access Token /api/v1.0/access-token/b2b and passed in headers as Bearer Token. The B2B Token is mandatory in all API requests.
```
Authorization: Bearer <b2b_token>
```

B2B2C Token

Generated Using Generate B2B2C Access Token /api/v1.0/access-token/b2b2c and passed in headers as Bearer Token.

API Name	Endpoint
API Account Unbinding	`/api/v1.0/registration-account-unbinding`
API Direct Debit Payment	`/api/v1.0/debit/payment-host-to-host`
API Verify OTP	`/api/v1.0/otp-verification`

Authorization-Customer: Bearer <b2b2c_token>

Authentication Tokens (B2B or B2B2C) generated once are only valid for 3600 seconds, after that a new token must be generated.

Signature Generation

All API requests must contain a valid signature header. The signature is passed in the X-Signature header of the HTTP Request.
The signature generation algorithm and contents to sign depend on the API being called. The table below mentions the APIs, signature algorithm, and content to sign.

Signature Algorithm	Content to Sign	Key to Sign	API Name
SHA256withRSA	`client_ID + "\|" + X-TIMESTAMP`	privateKey	Generate B2B Access Token
			Generate B2B2C Access Token
HMAC_SHA512	`HTTPMethod +":"+ URLPath +":"+ AccessToken +":"+ Lowercase(HexEncode(SHA-256(minify(RequestBody))))+":" + TimeStamp`	clientSecret	Get OAuth Code API
			API Account Binding
			API Account Unbinding
			API Direct Debit
			API Verify OTP

Signature Generation Example

Credential	Value
client_id	`fceda4da-ae95-4d14-8cb6-eef392139a1b`
client_secret	`fceda4da-ae95-4d14-8cb6-eef392139a2c`
private_key	`----BEGIN RSA PRIVATE KEY----- MIIBOgIBAAJBAJ9wKHG/JDCr+6eZ6as5hHspDhZEUkveTF9GnCcDqRVmS/E4rhYw niRfSSf2hfp516cYpC7zJ2AFB4id63T3lxECAwEAAQJALk7qQFdvEH/zYPOwTd4v 34HGKKuBZ63Sat3cXuyOQLt3OSj/lgRx/XELRjdLMADQrxTI0ijUvr9jqLB0I6O1 DQIhAMo3voVyYA0dmZvNWPRf6JzkFeexsXKmsrpNij9pwvPHAiEAyde1FPNTAeQn e0DW+gtE5dHg/omiZDYBKLBj4jb4bmcCIDhvSjqP6wJ+CkqTCopY4eA3P23EB5PJ tgOMdFKyP3gtAiEAgC0db2p94guTDvBEFJGndRJtAPdCSsUIw2AQbg1egi0CIH+a Z4Mar+3f+SFIElF+M+aD4AzzibGUJghJ03cbR6Pt ----END RSA PRIVATE KEY-----`
public_key	`----BEGIN PUBLIC KEY----- MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJ9wKHG/JDCr+6eZ6as5hHspDhZEUkve TF9GnCcDqRVmS/E4rhYwniRfSSf2hfp516cYpC7zJ2AFB4id63T3lxECAwEAAQ== ----END PUBLIC KEY-----`

Below are the examples for Signature Generation which are generated using the above dummy credentials. Please do not try to use the above credentials; they are just for reference.

SHA256WithRSA

String Format	`client_ID + "\|" + X-TIMESTAMP`
client_id	`fceda4da-ae95-4d14-8cb6-eef392139a1b`
X-TIMESTAMP	`2023-03-28T22:13:27+07:00`
String to Sign	`fceda4da-ae95-4d14-8cb6-eef392139a1b\|2023-03-28T22:13:27+07:00`
Hex Encoded Generated Signature	`2729b693fb377029422605c74a7f8d7c0769c6f733450ed9602b8152104328d47010bb88bb46a1e72b23ca2946c1807f753b60a38a53a6fd4e8e4cea8d26d6c8`

HMAC_SHA512

String Format	`http_method + ":" + url_path + ":" + access_token + ":" + Lowercase(HexEncode(SHA256(minify(RequestBody))))+ ":" + timestamp`
http_method	`POST`
url_path	`/api/v1.0/registration-account-binding`
access_token	`ed8f7f42a6d741fbb891bae654e81678`
JSON Body	`{ "partnerReferenceNo": "qic5taezfgta7yhn74u7cppr47wan027", "authCode": "8ecx3bnfk9bu2o4y0z8ur8pfhH12eltF", "merchantId": "AYOPOP" }`
Minified JSON Body	`{"partnerReferenceNo":"qic5taezfgta7yhn74u7cppr47wan027","authCode":"8ecx3bnfk9bu2o4y0z8ur8pfhH12eltF","merchantId":"AYOPOP"}`
timestamp	`2023-03-28T22:13:27+07:00`
String to Sign	`POST:/api/v1.0/registration-account-binding:ed8f7f42a6d741fbb891bae654e81678:626c42bf3d17e3a02bcabd6d265103135b6dd70e7af6341e87c56ad3650015ee:2023-03-28T22:13:27+07:00`
client_secret	`fceda4da-ae95-4d14-8cb6-eef392139a2c`
Encryption With client_secret	`2e955289baf7f297dda75b830c00f15b81a71710c2d0a0bbdf5884ae15bf47bb46e627a0b25cff1c1da16c42682ec69945950a1b120b6be490a53b7d613cf7e4`

200Successful scheduler cancellation.

defaultUnsuccessful API response.