Signature rules

Signing requests

1. Exclude sign.
2. Exclude fields whose value is "" or null; retain numeric 0 and string "0".
3. Sort parameter names in ascending ASCII order.
4. Join key=value pairs with &, then append &secret=app_secret.
5. Compute MD5 over the entire UTF-8 string, producing 32 lowercase hex characters.

Do not URL-encode values, change the amount representation or Base64-decode app_secret. A secret that looks like Base64 must still be used exactly as supplied.

Reproducible example

Example secret: DEMO_SECRET_NOT_A_LIVE_CREDENTIAL.

{
  "tenant_id": "DEMO0001",
  "app_key": "demo_app_key",
  "timestamp": "1791199800",
  "sign": "4ec5f59fa281ba9a12439f3adbb29fca"
}

app_key=demo_app_key&tenant_id=DEMO0001&timestamp=1791199800&secret=DEMO_SECRET_NOT_A_LIVE_CREDENTIAL

MD5 = 4ec5f59fa281ba9a12439f3adbb29fca

Verifying callbacks

Use the secret belonging to the order’s application and all received non-empty callback fields. Apply the same algorithm, but exclude signature, not sign. Do not add request-only app_key, timestamp or secret fields.

When present, pay_time and created_at participate exactly as received. Do not convert them to ISO8601, change timezone or reformat decimals before verification. Handle missing and empty fields using the rule above.

Offline utility

The project provides a local signing utility and signature function. They do not send requests or create orders. Replace credentials and generate a current timestamp for your own request.

Callback example signatures can be recomputed with the secret above.