Skip to content

App Listener

The App Listener is the device-side client that makes payment detection possible without a payment provider’s official API: it reads payment app notifications (DANA, GoPay Merchant, etc.) on the merchant’s phone as they arrive, parses the paid amount, and forwards it to this gateway’s inbound webhook — see Webhooks → Inbound for the exact contract it must call.

Currently implemented as a MacroDroid macro. The filename is versioned (-v1, -v2, …) so a future macro update ships as a new file instead of silently overwriting this one — existing tenants keep working off whichever version they already imported until they choose to reimport the newer one.

  1. Install MacroDroid from the Play Store.
  2. In MacroDroid: menu → Import/ExportImport Macro(s), then select the downloaded .mdr file. It imports as Payment Listener (QRIS Gateway).
  3. Open the macro and edit its Notification Received trigger — the application list ships empty on purpose, so tap Select Application and choose the merchant’s actual payment app (GoPay Merchant, DANA, etc.).
  4. Edit the HTTP Request action’s X-User-ID/X-Webhook-Secret header values — replace the YOUR_USER_ID/YOUR_WEBHOOK_SECRET placeholders with your tenant’s own (see Authentication for where those come from). The URL (https://api-qris-gateway.laboon.biz.id/v1/webhook/payment-status) is already set — it’s the same for every tenant on this gateway instance.
  5. Enable the macro. It fires on every matching notification and does not need further configuration.
AppPackageStatus
GoPay Merchantcom.gojek.gopaymerchantWorking
DANAWorking
ShopeePaycom.shopeepay.idWorking
Merchant BCAcom.bca.msbNot supported — see Known limitations
  1. Trigger on a new notification from the target payment app (e.g. GoPay Merchant).
  2. Parse the amount, timestamp, and payment status out of the notification text.
  3. Send POST /v1/webhook/payment-status with:
    • X-User-ID: the tenant’s user ID
    • X-Webhook-Secret: the tenant’s secret_key_live or secret_key_sandbox (whichever matches selects the mode — see Authentication)
    • JSON body matching the inbound contract

The endpoint always responds 200 on a successful call. In v2, if the POST doesn’t return 200 (e.g. network hiccup), the macro retries up to 3 times, 30 seconds apart, and shows a device notification if every attempt fails. v1 fires the POST once with no retry. See Webhooks for what happens on the gateway side for each outcome.

Continue to Errors