# RekberPay

> RekberPay is Indonesia's modern jasa rekber indonesia and escrow (rekening bersama) platform. We hold buyer funds in a neutral account until goods are confirmed received, protecting both parties from scams. Public APIs expose verified user directory data; authenticated APIs let registered apps initiate and track escrow transactions.

Visit https://rekberpay.com for the user-facing site. Get an API key from https://rekberpay.com/dashboard/settings → "API Keys" tab.

## Public docs

- [About RekberPay](https://rekberpay.com/about): mission, team, values
- [FAQ](https://rekberpay.com/faq): common questions about escrow, fees, KYC, dispute resolution
- [Public seller/buyer directory](https://rekberpay.com/u): browse verified users with ratings and transaction history
- [Public profile pattern](https://rekberpay.com/u/{username}): individual user public profile

## API documentation (docs.rekberpay.com)

- [Escrows API Reference](https://docs.rekberpay.com/reference/escrows): create escrows via `from-link`, public preview, and payment status polling.
- [Jasa Pembayaran API Reference](https://docs.rekberpay.com/reference/jasa-pembayaran): pay-on-behalf orders — fee quote, order creation, SLA-backed auto-refund. Not an escrow: no counterparty, no dispute, its own status enum.
- [Payments API Reference](https://docs.rekberpay.com/reference/payments): initiate payments and fetch available payment methods.
- [Authentication Guide](https://docs.rekberpay.com/authentication): how to sign partner URLs with HMAC-SHA256 (`sig` generation).
- [Webhooks Guide](https://docs.rekberpay.com/reference/webhooks): webhook event payloads (`payment.completed`, `escrow.released`, etc).
- [Errors Reference](https://docs.rekberpay.com/reference/errors): standard error codes returned by the API.

## Optional

- [Sitemap](https://rekberpay.com/sitemap.xml): all public pages
- [Robots](https://rekberpay.com/robots.txt): crawl rules

## Enterprise

- [RekberPay Enterprise](https://enterprise.rekberpay.com/): milestone escrow and signed API infrastructure for Indonesian B2B finance, ops, and procurement teams.

RekberPay Enterprise holds buyer funds in a regulated joint account, releases them against verified milestones, and pushes every state change to your ERP, marketplace, or finance stack over HMAC-signed REST APIs. KYB-verified counterparties, multi-approver payment workflows, and IDR + cross-border settlement (SGD, USD) via Midtrans, Xendit, Duitku, and TemanQRIS rails. Median approval SLA 4.2h. 42+ corporate clients, Rp 1.2B+ active deal volume.

### Capabilities

- Milestone escrow queue: break large supplier deals into gated milestones; funds release only when both parties sign off.
- KYB counterparty verification: company profiles with document, signer, bank account, and role review. 86% verified before first deal.
- Evidence vault: purchase orders, inspection reports, payout instructions — timestamped, immutable, and audit-ready.
- Deal pipeline & tracking: real-time progress across active deals; supplier onboarding, procurement, software delivery in one view.
- Cross-border support: 42+ counterparties (11 overseas); multi-currency settlement in IDR, SGD, USD.
- API + webhook bridge: push milestone approvals, dispute changes, and settlement updates to your ERP, marketplace, or finance stack.

### Developer surface

- REST APIs over HTTPS, JSON in / JSON out. SDK examples for Node.js, PHP, and Python.
- HMAC-SHA256 signed partner links (same canonical pattern as Stripe webhooks / AWS Sig v4): sort keys alphabetically, join with `&`, hex-encode digest.
- Idempotency-Key header on the money-moving mutations (escrow creation, all payment paths, Jasa Pembayaran, withdrawals, PPOB, voucher redemption), 24h cache, conflict detection. Not supported on disputes, ratings, support, or auth endpoints.
- Audit log per state change: actor, timestamp, IP, before/after.
- Sandbox-first: full sandbox with mock payments, same API surface as production. Most teams go live in 2 days.
- Payment state is read by polling `GET /api/escrows/:id/payment-status` and `GET /api/jasabayar/:id/payment-status`. Outbound partner webhooks are NOT yet implemented — there is no webhook registration and no delivery to partner URLs.

### Payment rails

- QRIS (all QR-enabled banks & wallets)
- Virtual Account (BCA, BNI, BRI, Mandiri)
- E-wallet (GoPay, OVO, ShopeePay, DANA)
- Bank transfer (manual + automated disbursement)
- International (PayPal, card rails — optional)
- Routed across Midtrans, Xendit, Duitku, TemanQRIS with automatic failover.

### Security & compliance

- Double-entry ledger reconciling every cent.
- Immutable audit log (actor, IP, before/after for every state change).
- KYC/AML controls: document review, sanctions screening, beneficial owner checks for high-value counterparties.
- PII encrypted in transit (TLS 1.2+). File-level encryption at rest is not yet
  implemented for uploaded identity documents; access is restricted and audit-logged.
  See https://rekberpay.com/privacy for the authoritative, current statement.
- Operational controls aligned with Bank Indonesia and OJK expectations for payment processors.
- Anomaly detection for duplicate payments, suspicious release patterns, and gateway drift.

### Links

- API documentation: https://docs.rekberpay.com
- Contact / sales: https://rekberpay.com/contact
- Authentication guide: https://docs.rekberpay.com/authentication
- Webhooks reference: https://docs.rekberpay.com/reference/webhooks