Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add roedyrustam/vibes-plug --skill doku-payment-gatewaygit clone --depth 1 https://github.com/roedyrustam/vibes-plugWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/roedyrustam/vibes-plug/doku-payment-gateway)<a href="https://agentmods.dev/skills/roedyrustam/vibes-plug/doku-payment-gateway"><img src="https://agentmods.dev/badge/skills/roedyrustam/vibes-plug/doku-payment-gateway/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/roedyrustam/vibes-plug/doku-payment-gateway"><img src="https://agentmods.dev/badge/skills/roedyrustam/vibes-plug/doku-payment-gateway.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00107 | $0.06623 |
| Opus 5.5 | $0.00043 | $0.02649 |
| Sonnet 5.5 | $0.00021 | $0.01325 |
| Haiku 4.5 | $0.00011 | $0.00662 |
Grade A, and why
doku-payment-gateway scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 580 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DOKU Payment Gateway Integration / Integrasi Payment Gateway DOKU
English
Orchestration & Integration
- Payments & Multi-Gateway Routing:
payment-gateway-expert,saas-billing,agentic-m2m-settlement,agentic-micro-economy-architect - AI Agentic Commerce & MCP:
doku-mcp-server,mcp-server-architect,ai-llm-integration-expert - Database & Atomic Idempotency:
database-orm-expert,saas-multi-tenant - Security & Post-Quantum Crypto:
post-quantum-crypto-migrator,zero-trust-secret-vault,autonomous-red-teamer - Async Processing & Observability:
async-queue-temporal-expert,data-telemetry-expert - Lifecycle & Governance:
brainstorming,zero-to-prod-orchestrator,session-memory-manager,anti-slop
Description
Expert guide for implementing DOKU Payment Gateway based on the official DOKU Developers Documentation. DOKU offers two primary integration models:
- DOKU Checkout (
/checkout/v1/payment): Hosted payment page or modal overlay (jokul-checkout-1.0.0.js). The fastest, single-integration solution supporting all payment channels (Virtual Accounts, Credit Cards, QRIS, E-Wallets, Convenience Stores, Paylater, Direct Debit) with built-in retry handling and cart recovery. Uses Non-SNAP HMAC-SHA256 signatures with request digest. - Direct API:
- SNAP BI Standard (Host-to-Host): Standardized open banking API mandated by Bank Indonesia. Employs OAuth 2.0 B2B token with Asymmetric RSA-SHA256, and HMAC-SHA512 for transactional endpoints (Direct VA, Direct QRIS, Direct Debit).
- Non-SNAP Direct API: Dedicated APIs for Credit Card Payment Page (
/credit-card/v1/payment-page), OVO Push Payment (/ovo-emoney/v1/payment), and Direct Paylater.
Integration Architecture Decision Matrix
| Dimension | DOKU Checkout (Hosted / Modal) | Direct API (SNAP BI Standard) | Direct API (Non-SNAP) |
|---|---|---|---|
| Primary Use Case | E-commerce, SaaS billing, mobile apps wanting instant multi-channel coverage | Bespoke in-app banking UI, automated dynamic VA generation, native QRIS display | Non-PCI DSS Card custom page, instant OVO push payment to phone |
| Supported Channels | All channels in 1 API (VA, CC, QRIS, E-Wallet, Alfa/Indomaret, Paylater, Direct Debit) | Specific endpoints: Bank Virtual Accounts, QRIS, Direct Debit | Credit Card 3DS, OVO Push, LinkAja, Paylater (Kredivo/Akulaku) |
| Frontend Effort | Minimal: Redirect to URL or trigger modal via loadJokulCheckout() |
High: Merchant builds custom payment UI for each channel | Medium: Merchant embeds card iframe/redirect or prompts phone |
| Signature Algorithm | HMACSHA256 with body Digest |
HMAC-SHA512 (Transactional) + RSA-SHA256 (B2B Token) |
HMACSHA256 with Digest (Card) or SHA256 checksum (OVO) |
| Endpoint Base | /checkout/v1/payment |
/virtual-accounts/bi-snap-va/v1.1/..., /snap-adapter/b2b/v1.0/qr/... |
/credit-card/v1/payment-page, /ovo-emoney/v1/payment |
| Check Status | GET /orders/v1/status/{invoice_number} (with order-level status) |
Channel status endpoint (e.g. /transfer-va/status, /qr-mpm-query) |
GET /orders/v1/status/{invoice_number} |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed 4ceef8831230
- 5d ago Changed · +1 lines d7e2081aa20b
- 8d ago Changed ce797044abcb
- 17d ago Changed 732a5b8410c6
- 22d ago Changed 6330e5157436
- 23d ago Changed · +328 lines · +29 tokens per session ad1a0dbe030c
- 1mo ago Changed · +17 lines · +7 tokens per session f36cd8d2ba67
- 1mo ago Changed cfe6c5f196bd
- 1mo ago Changed 760a8d2e5932
- 1mo ago First seen · 234 lines · 71 tokens per session scan A 839322dc7c8b
doku-payment-gateway is a skill published in the GitHub repository roedyrustam/vibes-plug (113 stars, last pushed yesterday), licensed MIT. It adds 107 tokens to every session and 6,623 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nodejs-backend-patterns
Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices architectures.
api-design-principles
Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers. Use when designing new APIs, reviewing API specifications, or establishing API design standards.
stripe-best-practices
Guides Stripe integration decisions across development and test environment planning (separate sandboxes vs the shared test mode sandbox), API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, tax and registrations (Stripe Tax…
commerce-app-business-config
Manage custom business configuration in an Adobe Commerce app. Use when the user wants to add, modify, or remove merchant-configurable settings (config fields, admin config, store configuration) exposed through Commerce Admin. Creates typed config fields (text, password, email, url, tel, boolean, list) in…
api-security-best-practices
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities.
builder
Implementing robust business logic, API integrations, data models, and reproducible AI image-generation code with type safety. Use for production implementation, Gemini image API pipelines, or interactive pair programming.