doku-checkout-js (Unofficial)

A standalone, lightweight Node.js client for DOKU Checkout V1 API. This library implements the official HMAC-SHA256 signature and SHA-256 Digest logic without any bulky official SDK dependencies, solving common "Internal Server Error" issues.

Security Warning ⚠️

IMPORTANT: This library is for Server-Side Use ONLY (Node.js, Next.js API Routes, etc.).

• Never use this library on the client-side (frontend).
• Never expose your DOKU_SECRET_KEY in your frontend code.
• Your backend should call this library and then pass the paymentUrl to your frontend.

Environment Variables

Create a .env file in your root directory and add your DOKU credentials:

DOKU_CLIENT_ID=BRN-...
DOKU_SECRET_KEY=SK-...

Installation

npm install axios doku-checkout-js

Configuration

Toggle between Sandbox and Production using the isProduction flag:

const config: DokuConfig = {
  clientId: "BRN-...",
  secretKey: "SK-...",
  isProduction: false // set to true for production
};

Basic Usage (Initiate Payment)

import { createDokuCheckout, DokuCheckoutRequest } from 'doku-checkout-js';

// ... config from above ...

const order: DokuCheckoutRequest = {
  order: {
    amount: 100000,
    invoice_number: "INV-001",
    currency: "IDR",
    callback_url: "https://yoursite.com/callback",
    line_items: [
      { name: "Product A", price: 100000, quantity: 1 }
    ]
  },
  customer: {
    name: "John Doe",
    email: "[email protected]"
  }
};

async function startPayment() {
  const response = await createDokuCheckout(config, order);
  console.log("Payment URL:", response.response.payment.url);
}

Advanced: Webhook Verification 🛡️

When DOKU sends a payment notification to your webhook URL, you must verify the signature to ensure the data is legit.

import { verifyNotificationSignature } from 'doku-checkout-js';

// Inside your Express/Next.js Webhook handler:
const isValid = verifyNotificationSignature({
  headers: req.headers, // Should include 'client-id', 'request-id', etc.
  body: req.body,        // Raw body or parsed JSON
  secretKey: process.env.DOKU_SECRET_KEY,
  notificationPath: "/api/doku/webhook" // Your endpoint path
});

if (isValid) {
  // Process payment status (SUCCESS/FAILED)
}

License

MIT