Hubungkan bisnis Anda ke NokosKilat

[Klien Anda]
   │ 1. GET  /balance                 cek saldo
   │ 2. GET  /countries → /services → /products
   │ 3. POST /orders  (Idempotency-Key)   saldo dipotong 1x
   ▼
[NokosKilat] ── nomor + order_id ──► klien
   │ 4a. webhook order.otp_received (terdeteksi saat polling)
   │ 4b. GET /otp/{order_id} tiap 5–10 detik
   ▼
 OTP masuk → status "diterima" → "selesai"
 Tidak ada OTP → POST /orders/{id}/cancel atau kedaluwarsa
              → status "dibatalkan"/"gagal" → refund otomatis 1x

X-API-Key: nk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# atau
Authorization: Bearer nk_live_xxxx…

https://nokoskilat.com/api/v1

{ "ok": true,  "data": { … } }
{ "ok": false, "error": { "code": "SALDO_KURANG", "message": "Saldo tidak mencukupi…" } }

# 1) Buat pesanan
curl -X POST https://nokoskilat.com/api/v1/orders \
  -H "X-API-Key: $NOKOSKILAT_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-$(date +%s)" \
  -d '{"country_id":6,"service_id":1,"product_id":9912}'

# 2) Polling OTP tiap 5–10 detik
curl "https://nokoskilat.com/api/v1/otp/ORDER_ID" -H "X-API-Key: $NOKOSKILAT_API_KEY"

# 3) Tidak ada OTP? Batalkan minimal 3 menit (180 detik) setelah order,
#    selama OTP belum masuk — saldo kembali otomatis sekali.
sleep 180
curl -X POST "https://nokoskilat.com/api/v1/orders/ORDER_ID/cancel" -H "X-API-Key: $NOKOSKILAT_API_KEY"

// npm i telegraf  —  BOT_TOKEN=.. NOKOSKILAT_API_KEY=.. node bot.mjs
// Versi lengkap (Server 1–5, Email, retry, /batal): unduh di Starter Kit.
import { Telegraf } from "telegraf";
import { randomUUID } from "node:crypto";
const BASE = "https://nokoskilat.com/api/v1";
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

// Timeout 15 dtk; retry hanya timeout/5xx/429 dengan Idempotency-Key yang SAMA.
async function api(path, { method = "GET", body, idem, tries = 3 } = {}) {
  for (let i = 1; ; i++) {
    try {
      const res = await fetch(BASE + path, { method, signal: AbortSignal.timeout(15_000),
        headers: { "X-API-Key": process.env.NOKOSKILAT_API_KEY, "Content-Type": "application/json",
                   ...(idem ? { "Idempotency-Key": idem } : {}) },
        body: body ? JSON.stringify(body) : undefined });
      const j = await res.json().catch(() => null);
      if (j?.ok) return j.data;
      if (!(res.status === 429 || res.status >= 500) || i >= tries) throw new Error(j?.error?.message ?? "HTTP " + res.status);
    } catch (e) { if (i >= tries || e.name !== "TimeoutError") throw e; }
    await sleep(1000 * 2 ** i);
  }
}

async function waitOtp(id) {                     // polling tiap 7 detik (5–10 dtk)
  for (let i = 0; i < 170; i++) {                // ±20 menit
    await sleep(7_000);
    const o = await api(`/otp/${id}`, { tries: 1 }).catch(() => null);
    if (o?.latest_code) return o.latest_code;
    if (o && ["selesai", "dibatalkan", "gagal", "kedaluwarsa"].includes(o.status)) return null;
  }
  return null;
}

const bot = new Telegraf(process.env.BOT_TOKEN);
const safe = (fn) => async (ctx) => { try { await fn(ctx); } catch (e) { ctx.reply("⚠️ " + e.message); } };

// /beli <server 1-5> <country_id> <service> <product_id>
// Server 1–2: service = service_id (angka) · Server 3–5: service = kode (mis. wa)
bot.command("beli", safe(async (ctx) => {
  const [, srv, country, service, product] = ctx.message.text.split(/\s+/);
  const s = Number(srv);
  const body = { country_id: Number(country), product_id: Number(product),
                 ...(s <= 2 ? { service_id: Number(service) } : { service }) };
  const o = await api(s === 1 ? "/orders" : `/servers/${s}/orders`, { method: "POST", body, idem: randomUUID() });
  ctx.reply(`Nomor: ${o.phone}\nMenunggu OTP…`);
  const code = await waitOtp(o.id);
  ctx.reply(code ? `Kode OTP: ${code}` : `Belum ada OTP. /batal ${o.id}`);
}));

// /email [site] : lihat stok; /email <site> <domain> <product_id> : beli
bot.command("email", safe(async (ctx) => {
  const [, target = "telegram.com", domain, product] = ctx.message.text.trim().split(/\s+/);
  const site = target.trim().toLowerCase();
  const offers = await api(`/email/offers?site=${encodeURIComponent(site)}`);
  if (!domain && !product) return ctx.reply(offers.flatMap((d) => d.products.filter((p) => p.stock > 0).map((p) => `${d.domain} · #${p.id} · Rp${p.price}\n/email ${site} ${d.domain} ${p.id}`)).join("\n") || "Stok email belum tersedia.");
  const selected = offers.find((d) => d.domain === domain)?.products.find((p) => p.id === Number(product) && p.stock > 0);
  if (!selected) return ctx.reply("Pilih domain dan produk berstok dari /email " + site);
  const o = await api("/email/orders", { method: "POST", body: { site, domain, product_id: selected.id }, idem: randomUUID() });
  ctx.reply(`Email: ${o.email}\nMenunggu kode…`);
  const code = await waitOtp(o.id);
  ctx.reply(code ? `Kode: ${code}` : `Belum ada pesan. /batal ${o.id}`);
}));

// Refund otomatis maksimal 1x oleh NokosKilat
bot.command("batal", safe(async (ctx) => {
  const id = ctx.message.text.split(/\s+/)[1];
  const r = await api(`/orders/${id}/cancel`, { method: "POST", idem: "cancel-" + id });
  ctx.reply("Status: " + r.status);
}));

bot.launch();

POST https://domainanda.com/webhook/nokoskilat
X-NokosKilat-Event: order.number_ready
X-NokosKilat-Timestamp: 1791459200
X-NokosKilat-Signature: sha256=9f2c…

{
  "id": "b8d1f0b2-…",
  "event": "order.number_ready",
  "created_at": "2026-10-08T09:12:44Z",
  "data": { "order_id": "3f6c…", "phone": "+62812xxxx" }
}

// Node.js / Express — verifikasi signature
import crypto from "node:crypto";
app.post("/webhook/nokoskilat", express.raw({ type: "application/json" }), (req, res) => {
  const ts = req.header("X-NokosKilat-Timestamp");
  const sig = req.header("X-NokosKilat-Signature");          // "sha256=<hex>"
  const expected = "sha256=" + crypto.createHmac("sha256", process.env.NOKOSKILAT_WEBHOOK_SECRET)
    .update(`${ts}.${req.body}`).digest("hex");
  if (!sig || sig.length !== expected.length || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) return res.sendStatus(401);
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.sendStatus(401); // anti-replay
  const event = JSON.parse(req.body);                          // proses idempoten via event.id
  res.sendStatus(200);
});