Host-to-Host API * v1

API Documentation

Integrate your website system with us as an H2H product supplier.

Introduction

All requests use POST method with JSON body. Base URL endpoint:

POST https://www.bybanana.my/api/v1/{endpoint}

Required Headers

Content-Type: application/json

Authentication & Signature

Each request must include api_id, api_key, and signature in the JSON body. Signature is calculated using MD5 formula.

API ID

API Key

Signature Formula

signature = HMAC-SHA256(
    METHOD + "|" + PATH + "|" + timestamp + "|" + nonce,
    api_key
)

Activate the API Access Status toggle in the API Integration menu, and make sure your server IP is registered in IP Whitelist so requests are not rejected.

Cara menghitung signature (PHP)

$apiId     = 'API_ID_ANDA';
$apiKey    = 'API_KEY_ANDA';
$method    = 'POST';
$path      = '/api/v1/profile';          // path LENGKAP dari base_url('api/v1')
$timestamp = time();                     // unix timestamp (detik)
$nonce     = bin2hex(random_bytes(16));  // string acak unik, min 8 karakter

$canonical = $method . '|' . $path . '|' . $timestamp . '|' . $nonce;
$signature = hash_hmac('sha256', $canonical, $apiKey);

$payload = [
    'api_id'    => $apiId,
    'timestamp' => $timestamp,
    'nonce'     => $nonce,
    'signature' => $signature,
    // ...field lain (order_id, service_id, dst)
];

api_key TIDAK dikirim dalam body — hanya dipakai untuk menghitung signature. Field timestamp (±300 detik dari waktu server) dan nonce (unik, tidak boleh dipakai ulang) wajib dikirim. Tiap request butuh signature berbeda. Skema lama md5(api_id + api_key) sudah tidak didukung.

Example Body (all endpoints)

{
  "api_id": "YOUR_API_ID",
  "timestamp": 1700000000,
  "nonce": "a1b2c3d4e5f6",
  "signature": "HMAC-SHA256(POST|/api/v1/profile|1700000000|a1b2c3d4e5f6, api_key)"
}

Check Profile / Balance

Retrieve reseller account information: username, balance, and price level (role).

POST https://www.bybanana.my/api/v1/profile

Example Request

{
  "api_id": "YOUR_API_ID",
  "timestamp": 1700000000,
  "nonce": "a1b2c3d4e5f6",
  "signature": "HMAC-SHA256(POST|/api/v1/profile|1700000000|a1b2c3d4e5f6, api_key)"
}

Response

{
  "status": true,
  "msg": "Successfully retrieved profile data",
  "data": {
    "username": "resellerku",
    "balance": "150000",
    "role": "Gold"
  }
}

Service List (Price List)

Retrieve all products with prices according to your level (Basic / Gold / Platinum). Use id as service_id when ordering.

POST https://www.bybanana.my/api/v1/service

Example Request

Parameter	Type	Description
`api_id` *	string	Authentication & Signature
`timestamp` *	integer	Unix timestamp (detik), ±300 detik dari waktu server.
`nonce` *	string	String acak unik (min 8 karakter), tidak boleh dipakai ulang.
`signature` *	string	HMAC-SHA256(METHOD\|PATH\|timestamp\|nonce, api_key)
`region`	string	Opsional. Filter hasil ke 1 region saja. Bisa diisi nama (`"Indonesia"`) atau kode (`"ID"`), tidak case-sensitive. Kalau dikosongkan, semua region dikembalikan sekaligus. Alias: `negara`.

{
  "api_id": "YOUR_API_ID",
  "timestamp": 1700000000,
  "nonce": "a1b2c3d4e5f6",
  "signature": "HMAC-SHA256(POST|/api/v1/service|1700000000|a1b2c3d4e5f6, api_key)",
  "region": "Indonesia"
}

Response

[
  {
    "status": true,
    "msg": "Successfully retrieved service data",
    "data": {
      "id": "101",
      "game": "Mobile Legends",
      "game_display": "Mobile Legends (Indonesia)",
      "region_code": "ID",
      "region_name": "Indonesia",
      "nama_layanan": "86 Diamonds",
      "negara": "ID",
      "harga": {
        "regular": "21500",
        "basic": "21000",
        "gold": "20500",
        "platinum": "20000"
      },
      "status": "available"
    }
  }
]

Objek harga berisi 4 tingkatan harga sesuai role akun reseller Anda: regular (akun tanpa subscription aktif), basic, gold, dan platinum. Harga yang dibebankan saat order (endpoint /order) otomatis mengikuti role akun Anda saat ini — lihat field role pada respons /profile di atas.

Field negara berisi kode region produk (ID, MY, PH, SG, TH, …), diturunkan dari Master Type yang terkait dengan produk (produk.tipe → product_types → master_types.negara).

Field baru — disarankan dipakai untuk integrasi baru:
• game_display — nama game yang sudah termasuk region, siap tampil langsung sebagai judul/brand di listing Anda (mis. "Mobile Legends (Indonesia)"). Kalau region belum terdeteksi untuk suatu produk, nilainya sama dengan game (tanpa suffix).
• region_code — kode ISO region ("ID", "MY", dst), sama isinya dengan negara. Bisa null kalau region belum terdeteksi.
• region_name — nama region dalam bentuk terbaca manusia ("Indonesia"), sesuai penamaan Master Type yang admin atur sendiri di panel Bybanana.

Field game tetap dipertahankan apa adanya (nama game polos, tanpa suffix region) untuk kompatibilitas mundur — integrasi lama tidak akan rusak. Kalau ingin listing game Anda otomatis terpisah per region (mis. "Mobile Legends (Indonesia)" dan "Mobile Legends (Malaysia)" sebagai 2 entri berbeda), kelompokkan produk berdasarkan game_display, bukan game.

Create Order

Create a new transaction. Balance will be automatically deducted according to your price level. order_id is created by your system and must be unique.

POST https://www.bybanana.my/api/v1/order

Parameters

Parameter	Type	Description
`order_id` *	string	Unique transaction ID from your system
`service_id` *	string	Service ID (from /service endpoint)
`target_id` *	string	User ID / destination number
`target_server`	string	Zone / Server (if applicable)

Example Request

{
  "api_id": "YOUR_API_ID",
  "timestamp": 1700000000,
  "nonce": "a1b2c3d4e5f6",
  "signature": "HMAC-SHA256(POST|/api/v1/order|1700000000|a1b2c3d4e5f6, api_key)",
  "order_id": "TRX-1700000001",
  "service_id": "101",
  "target_id": "123456789",
  "target_server": "2001"
}

Successful Response

{
  "status": true,
  "msg": "Order successful! Order is being processed",
  "data": {
    "order_id": "TRX-1700000001",
    "nama_layanan": "86 Diamonds",
    "service_id": "101",
    "target_id": "123456789",
    "target_server": "2001",
    "status": "Proses",
    "note": ""
  }
}

Error Responses

{
  "status": false,
  "msg": "order_id wajib diisi"
}

{
  "status": false,
  "msg": "order_id sudah tersedia pada sistem kami",
  "data": { "status": "error" }
}

{
  "status": false,
  "msg": "service_id tidak ditemukan"
}

{
  "status": false,
  "msg": "Saldo anda tidak mencukupi"
}

Check Transaction Status

Check the current status of a transaction based on order_id.

POST https://www.bybanana.my/api/v1/status

Parameters

Parameter	Type	Description
`order_id` *	string	Transaction ID to check

Example Request

{
  "api_id": "YOUR_API_ID",
  "timestamp": 1700000000,
  "nonce": "a1b2c3d4e5f6",
  "signature": "HMAC-SHA256(POST|/api/v1/status|1700000000|a1b2c3d4e5f6, api_key)",
  "order_id": "TRX-1700000001"
}

Response

{
  "status": true,
  "msg": "Transaction details retrieved successfully",
  "data": {
    "order_id": "TRX-1700000001",
    "status": "Sukses",
    "note": "SN: 1234567890"
  }
}

Check Nickname

Validate game User ID to get the account owner's nickname before ordering.

POST https://www.bybanana.my/api/v1/nickname

This endpoint does not require authentication (api_id / api_key / signature). Just send code, id, and zone. The response is passed through as-is from the nickname provider.

Example Request

{
  "code": "mlbb",
  "id": "123456789",
  "zone": "2001"
}

Callback / Webhook

When order status changes (e.g. from Processing to Success / Failed), our system automatically sends a POST JSON to the Callback URL you set in the API Integration menu.

Payload We Send

POST {Callback URL Anda}
Content-Type: application/json
X-Signature: md5(api_id + order_id + status + webhook_secret)

{
  "event": "order.status",
  "order_id": "TRX-1700000001",
  "service_id": "101",
  "product": "86 Diamonds",
  "status": "Sukses",
  "note": "SN: 1234567890",
  "sn": "SN: 1234567890",
  "target_id": "123456789",
  "target_server": "2001",
  "price": 20500,
  "timestamp": 1700000123,
  "signature": "md5(api_id + order_id + status + webhook_secret)"
}

Signature Verification (PHP)

$payload = json_decode(file_get_contents('php://input'), true);
$expected = md5($api_id . $payload['order_id'] . $payload['status'] . $webhook_secret);
if ($_SERVER['HTTP_X_SIGNATURE'] === $expected) {
    // valid — update status order di sistem Anda
    http_response_code(200);
    echo 'OK';
}

Reply with HTTP 200 for callback to be considered successful. If failed, callback status can be viewed in API Integration → Callback History.

Transaction Status List

Statuses that may appear in the status field:

Pending Processing Success Failed Refund