Midtrans Payment Gateway for Odoo (Indonesia)

Midtrans is one of Indonesia's most widely used payment aggregators, and its Snap product exposes a single hosted checkout that covers credit/debit cards, e-wallets (GoPay, ShopeePay, QRIS), virtual-account bank transfer (BCA, BNI, BRI, Mandiri, Permata), over-the-counter retail outlets (Alfamart, Indomaret), and installment options — all behind one integration. This module wires that Snap experience into Odoo's native payment framework so it works consistently across the eCommerce checkout (Odoo Website / Sales), the customer portal for invoice payment, and quotation online payment.

Under the hood we implement a proper Odoo payment provider. A new payment.provider record (code = 'midtrans') carries your Client Key, Server Key and sandbox/production toggle as encrypted config fields; a payment.transaction extension maps Odoo's transaction lifecycle to Midtrans order and transaction states. On checkout the customer either sees the Snap popup rendered over your Odoo page (via the Snap.js client) or is redirected to Midtrans-hosted Snap, then returned to Odoo's standard confirmation route. Server-to-server confirmation is authoritative: a controller endpoint receives Midtrans's HTTP notification (webhook), verifies the SHA-512 signature_key (order_id + status_code + gross_amount + Server Key) before trusting any status, and moves the payment.transaction to done / pending / cancelled / error accordingly — so a closed browser tab or a spoofed callback can never mark an order paid.

Amounts and currency follow Indonesian rules: IDR is a zero-decimal currency at Midtrans, so we round and format gross_amount to whole rupiah, guard against fractional-tax rounding drift, and reconcile the exact settled amount back to the Odoo transaction. Refunds are supported from within Odoo — an authorized user triggers a refund on a captured transaction and the module calls Midtrans's refund API, then writes the result back to the transaction and posts a message in the chatter for audit.

Security is modeled the Odoo way: ir.model.access.csv grants and record rules keep gateway credentials and transaction actions restricted to Accounting/Payment managers, the webhook controller is auth='public' but validated by signature (never by trust), and no secret is ever logged. The module ships tested against Odoo 17, 18 and 19 and works on both Community and Enterprise (Enterprise adds nicer accounting reconciliation UX, but the gateway itself does not require it). Everything is delivered as a clean, versioned addon with a documented __manifest__.py, so it upgrades cleanly and your team can read exactly what it does.

Because it's build-to-order, you get a gateway tuned to your catalog, tax setup, multi-company/multi-currency layout and preferred Snap payment channels — not a generic binary you have to bend your workflow around.