DOKU Malaysia API Reference
Home
Products
Products
  • Checkout
  • Payment
  • Cards Payment
DOKU Docs
Home
Products
Products
  • Checkout
  • Payment
  • Cards Payment
DOKU Docs
  1. Cards Payment
  • Introduction
  • Getting Started
    • Create Account
    • Authentication & API Keys
    • Make your first API call
  • Checkout
    • Overview
    • Create Checkout
      POST
    • Retrieve Checkout Status
      GET
  • Payment
    • Overview
    • Create Payment
    • Get Bank List - FPX
    • Retrieve Payment Status
  • Cards Payment
    • Overview
    • Payment Form
      • Request Payment
    • Host-to-Host Payment
      • Check Three D Secure
      • Charge Payment
      • Capture Authorized Payment
    • Request Refund
      POST
    • Unbind Token
      POST
    • Check Status
      GET
  • Notification
    • Overview
    • Setup Notification URL
    • Retry Notification
    • Sample Notification - Global
    • Sample Notification - Cards
  • Technical Reference
    • Authentication & Integrity
    • Idempotency
    • Data Type
    • Order & Transaction Status
    • Postman Collection
    • Response Code
      • Error Code
    • API Version
      • Create Checkout
      • Create Payment
      • Get Bank List - FPX
      • Retrieve Checkout
      • Retrieve Payment
    • Signature
      • Signature - Global
        • Signature
      • Signature - Cards Payment API
        • Signature Component from Request Header
        • Signature Component from Response Header
        • Signature from API Get Method
        • Sample Code
  1. Cards Payment

Overview

By using this Cards, your customers can pay their order with their credit card or any online transaction capable debit card. DOKU has partnered with various banks and principals (Visa, MasterCard) to provide a secure and seamless payment experience for your customers.
If you are a non PCI DSS merchant, you can integrate with our Payment Form, where we will process customer's card information securely for you.
Cards API Specifications
Currently Cards will have a different API Specification with other channels.
In the future, Cards channel will have be included on Payment API so this API will be obsolete
💡
What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle branded credit cards from the major card schemes. The PCI Standard is mandated by the card brands but administered by the Payment Card Industry Security Standards Council.

Supported Payment Type#

Payment TypeDescription
SALEThis is a single transaction where the authorization (approval of funds) and capture (deduction from the card) happen at the same time. It’s common for retail purchases where funds are immediately processed.
MOTOThis is a type of transaction where the card is not physically present, typically used in orders taken over the phone or by mail. Merchants manually enter the card details into the system.

Integration Steps#

Merchant Initiate#

Here is the overview of how Merchant Initiate payment works:
1.
First Time Payment
a. Hit the Request Payment API
b. Display Payment Page
Tick save card details to save your card with tokenization.
image.png
2.
Merchant Input Card Credentials and Proceed Payment
a. DOKU process Payment & return to success/failed page depending on result from processor
b DOKU send HTTP notification including generated token_id which will be used to perform subsequent payment. Learn how to handle the notification from DOKU from here.
3.
OPTIONAL - Authorize Capture Payment
a. Merchant hit Capture Authorized Payment API using authorize_id
b. DOKU return payment status (success/fail)

Customer Initiate#

Here is the overview of how Customer Initiate payment works:
1.
Initiate Payment
a. Merchant hit the Check 3DS API
b. Return 3DS Page to Customer
c. Customer input OTP on 3DS Page
d. Redirect to Callback URL
2.
Proceed Payment
a. Merchant hit Charge Payment API.
b. DOKU process Payment & merchant will show their success/failed page depending on result from processor
c. DOKU send HTTP notification including generated token_id which will be used to perform subsequent payment. Learn how to handle the notification from DOKU from here.
3.
OPTIONAL - Authorize Capture Payment
a. Merchant hit Capture Authorized Payment API using authorize_id
b. DOKU return payment status (success/fail)

Check Status#

Check Status
In addition to receiving notifications, you can also retrieve the transaction status by using the Check Status API. Learn how to use Check Status API here.
Token ID on Check Status
token_id that will be sent within notification can also be received with Check Status API. But keep in note that token_id will be only received when hit Check Status for first time saving card on Success status.

After Payment#

There are several things that you can do after the payment:
a. Refund
b. Unbind Token

Refund#

You can request void or refund using Request Refund API.
INFO
1.
If you are using Cards Aggregator service, you can process Void or Refund.
2.
If you are using Cards Direct service, please consult with your acquiring bank through sales to learn more about whether your credential (MID) supports online refund or not, otherwise refund will be processed manually.
3.
Refund can be processed partially and multiple times as long as the total amount from original transaction hasnt been reached
Refund Status Mapping
These are the possible response status for Refund API:
ResponseDescription
VOIDIf the funds has not settled to your bank account. The refund.amount must equal to order.amount, otherwise will fail
PARTIAL_REFUNDIf the funds has settled to your bank account, and the refund.amount is less than order.amount
FULL_REFUNDIf the funds has settled to your bank account, and the refund.amount is equal to order.amount
Refund Status
You can also use Check Status API to check is your transaction is already refunded or not. Learn how to use Check Status API here.

Unbind Token#

If you want to delete a token that is already saved with tokenization, you can use the Unbind Token API on this page.

Testing Credentials#

These are the Card Credentials that is used for testing purposes on Sandbox Environment.
Expiry Date and CVV
For Expiry Date, please enter any valid future date in the format MM/YY.
For CVV, please enter 100.
Here are the Card Numbers:
Card TypeCard NumberResponse CodeDescription
Master512091000000001200Frictionless
Master512091000000002000Challenge
Master512091000000003800Non 3DS
Master512091000000004605Challenge
Master512091000000005351Challenge
Master512091000000012962Challenge
Visa450919893490531600Frictionless
Visa450919893490532400Challenge
Visa450919893490533200Non 3DS
Visa450919893490534005Challenge
Visa450919893490000251Challenge
Visa450919893490001062Challenge
Modified at 2026-05-12 04:44:52
Previous
Retrieve Payment Status
Next
Request Payment
Built with