Incoming payments
Match bank credits against waiting orders by CSV, paste or webhook.
Incoming Payments matches credits from your bank against orders waiting for a transfer. Three routes in, all governed by the same rules: an exact amount, exactly one waiting order, never the same credit twice, and never a guess between two candidates.
The three routes
| Route | Use it when |
|---|---|
| Paste a column of amounts | You are reading figures off a statement on screen. |
| Upload a CSV | Your banking app exports one. Column names are recognised in Indonesian and English. |
| Webhook | A bank mutation service, or your own script, posts credits as they arrive. |
The paste box takes bare amounts, one per line. Anything that is not just a figure is reported rather than guessed at, so statement lines carrying dates and descriptions belong in the CSV route, where you map the columns.
Report-only first
Automatic matching starts in report-only mode: it records what it would have done and changes nothing. Watch it for a few days, agree with what it reports, and only then move it to marking orders paid.
The look-back window
A credit is matched only against orders placed within a number of days before it arrived, and never against an order placed after it. That upper bound is what stops a replayed old credit settling a brand new order that happens to come to the same figure.
If a figure you can see on Pending Transfers reports no match, the order has probably aged past the window. The result says which window was searched, so widen it and check again.
What is refused
- Debits. A line marked
DBorDR, carrying a trailing minus, or written with a currency prefix before the minus sign, is refused rather than read as money arriving. - Repeats. The same credit cannot settle a second order.
- Ambiguity. Two waiting orders matching one credit means neither is settled.
Webhook security
The webhook address comes with a secret. Send it as an X-IBFWP-Secret header, or as a secret parameter, and requests without it are refused. Generating a new secret stops the old one working immediately.
No bank credentials are stored and nothing is polled. Credits only arrive where you point something at the webhook, or where you upload or paste them yourself.