保护伞II 支付网关 · 商户对接文档

复制<?php
$appKey = '你的 appKey';
$p = [
    'merchantNo' => '88001', 'appId' => 'app_demo',
    'mchOrderNo' => 'ORD20260928001', 'payMethod' => 'alipay',
    'bankCode' => '9311',
    'amount' => '0.01', 'currency' => 'CNY', 'subject' => '测试商品',   // 元
    'notifyUrl' => 'https://m.example.com/pay/notify',
    'timestamp' => (string) round(microtime(true) * 1000),   // 毫秒
    'nonce' => bin2hex(random_bytes(16)),
];
ksort($p);                                   // ASCII 升序
$parts = [];
foreach ($p as $k => $v) { $parts[] = "$k=$v"; }
$signSrc = implode('&', $parts) . '&key=' . $appKey;
$p['sign']     = strtoupper(md5($signSrc));  // MD5 大写
$p['signType'] = 'MD5';

$ch = curl_init('https://api.60185.com/api/pay/unifiedOrder');
curl_setopt_array($ch, [
    CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode($p, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES),
]);
$res = json_decode(curl_exec($ch), true);
// $res['code'] === 200 即成功；用 $res['data']['payEntryUrl'] 引导付款

复制import time, uuid, hashlib, json, requests

APP_KEY = '你的 appKey'
p = {
    'merchantNo': '88001', 'appId': 'app_demo',
    'mchOrderNo': 'ORD20260928001', 'payMethod': 'alipay',
    'bankCode': '9311',
    'amount': '0.01', 'currency': 'CNY', 'subject': '测试商品',   # 元
    'notifyUrl': 'https://m.example.com/pay/notify',
    'timestamp': str(int(time.time() * 1000)),   # 毫秒
    'nonce': uuid.uuid4().hex,
}
base = '&'.join('%s=%s' % (k, p[k]) for k in sorted(p) if p[k] != '')
sign = hashlib.md5((base + '&key=' + APP_KEY).encode('utf-8')).hexdigest().upper()
p['signType'] = 'MD5'
p['sign'] = sign

r = requests.post('https://api.60185.com/api/pay/unifiedOrder',
                  data=json.dumps(p, ensure_ascii=False).encode('utf-8'),
                  headers={'Content-Type': 'application/json'}, timeout=10)
res = r.json()
# res['code'] == 200 即成功；用 res['data']['payEntryUrl'] 引导付款

复制const crypto = require('crypto');
const APP_KEY = '你的 appKey';

const p = {
  merchantNo: '88001', appId: 'app_demo',
  mchOrderNo: 'ORD20260928001', payMethod: 'alipay',
  bankCode: '9311',
  amount: '0.01', currency: 'CNY', subject: '测试商品',   // 元
  notifyUrl: 'https://m.example.com/pay/notify',
  timestamp: String(Date.now()),                 // 毫秒
  nonce: crypto.randomBytes(16).toString('hex'),
};
const base = Object.keys(p).sort()
  .filter(k => p[k] !== '')
  .map(k => `${k}=${p[k]}`).join('&');
const sign = crypto.createHash('md5')
  .update(base + '&key=' + APP_KEY).digest('hex').toUpperCase();
p.signType = 'MD5';
p.sign = sign;

fetch('https://api.60185.com/api/pay/unifiedOrder', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(p),
}).then(r => r.json()).then(res => {
  // res.code === 200 即成功；用 res.data.payEntryUrl 引导付款
});

复制// 依赖：github.com/google/uuid；md5 用标准库
package main

import (
	"bytes"	"crypto/md5"	"encoding/hex"	"encoding/json"	"fmt"	"net/http"	"sort"	"strings"	"time"
	"github.com/google/uuid"
)

const appKey = "你的 appKey"

func md5HexUpper(s string) string {
	sum := md5.Sum([]byte(s))
	return strings.ToUpper(hex.EncodeToString(sum[:]))
}

func main() {
	p := map[string]string{
		"merchantNo": "88001", "appId": "app_demo",
		"mchOrderNo": "ORD20260928001", "payMethod": "alipay",
		"bankCode": "9311",
		"amount": "0.01", "currency": "CNY", "subject": "测试商品", // 单位：元
		"notifyUrl": "https://m.example.com/pay/notify",
		"timestamp": fmt.Sprintf("%d", time.Now().UnixMilli()), // 毫秒
		"nonce": strings.ReplaceAll(uuid.NewString(), "-", ""),
	}
	keys := make([]string, 0, len(p))
	for k, v := range p {
		if v != "" { keys = append(keys, k) } // 只对非空参数签名
	}
	sort.Strings(keys) // ASCII 升序
	parts := make([]string, 0, len(keys))
	for _, k := range keys { parts = append(parts, k+"="+p[k]) }
	signSrc := strings.Join(parts, "&") + "&key=" + appKey

	p["signType"] = "MD5"
	p["sign"] = md5HexUpper(signSrc) // MD5 转大写

	body, _ := json.Marshal(p)
	resp, err := http.Post("https://api.60185.com/api/pay/unifiedOrder",
		"application/json", bytes.NewReader(body))
	if err != nil { panic(err) }
	defer resp.Body.Close()
	var out struct { Code int `json:"code"`; Msg string `json:"msg"`; Data struct{ PayEntryUrl string `json:"payEntryUrl"` } `json:"data"` }
	json.NewDecoder(resp.Body).Decode(&out)
	// out.Code == 200 即成功；用 out.Data.PayEntryUrl 引导用户打开付款
}

复制// 依赖：cpp-httplib（单头文件）+ OpenSSL（MD5）
// g++ main.cpp -o pay -lssl -lcrypto
#include <httplib.h>
#include <openssl/md5.h>
#include <map> #include <string> #include <vector> #include <sstream>
#include <iomanip> #include <chrono> #include <random> #include <algorithm>

static std::string md5Upper(const std::string& s) {
    unsigned char d[MD5_DIGEST_LENGTH];
    MD5(reinterpret_cast<const unsigned char*>(s.data()), s.size(), d); // OpenSSL 1.x；3.x 用 EVP_Digest
    std::ostringstream o;
    for (unsigned char c : d) o << std::hex << std::uppercase << std::setw(2) << std::setfill('0') << (int)c;
    return o.str();
}

int main() {
    const std::string appKey = "你的 appKey";
    std::map<std::string, std::string> p;   // std::map 天然按 key ASCII 升序
    p["merchantNo"] = "88001";              p["appId"] = "app_demo";
    p["mchOrderNo"] = "ORD20260928001";     p["payMethod"] = "alipay";
    p["bankCode"] = "9311";
    p["amount"] = "0.01";                   p["currency"] = "CNY";   // 单位：元
    p["subject"] = "测试商品";
    p["notifyUrl"] = "https://m.example.com/pay/notify";
    p["timestamp"] = std::to_string( std::chrono::duration_cast<std::chrono::milliseconds>(
                           std::chrono::system_clock::now().time_since_epoch()).count() );   // 毫秒
    p["nonce"] = []{ std::random_device rd; std::ostringstream s;
                     for (int i = 0; i < 8; ++i) s << std::hex << rd(); return s.str(); }();

    std::string base;                                                    // k=v&k2=v2 升序拼接
    for (auto& kv : p) { if (!base.empty()) base += "&"; base += kv.first + "=" + kv.second; }
    p["sign"] = md5Upper(base + "&key=" + appKey);                        // MD5 转大写
    p["signType"] = "MD5";

    std::string jsonBody = "{";                                          // 手工拼 JSON（UTF-8 原文）
    for (auto& kv : p) { jsonBody += "\"" + kv.first + "\":\"" + kv.second + "\","; }
    jsonBody.back() = '}';

    httplib::Client cli("https://api.60185.com");
    auto res = cli.Post("/api/pay/unifiedOrder", jsonBody, "application/json");
    // res->status == 200 且响应体 code==200 即成功；取 data.payEntryUrl 引导付款
}

复制// .NET 6+ / C#（System.Text.Json + HttpClient，无需第三方依赖）
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

string appKey = "你的 appKey";
var p = new Dictionary<string, string>
{
    ["merchantNo"] = "88001", ["appId"] = "app_demo",
    ["mchOrderNo"] = "ORD20260928001", ["payMethod"] = "alipay",
    ["bankCode"] = "9311",
    ["amount"] = "0.01", ["currency"] = "CNY", ["subject"] = "测试商品",  // 单位：元
    ["notifyUrl"] = "https://m.example.com/pay/notify",
    ["timestamp"] = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds().ToString(),  // 毫秒
    ["nonce"] = Guid.NewGuid().ToString("N"),
};

// 非空参数按 key ASCII 升序 → k=v&... → 尾随 &key=appKey → MD5 大写
var signSrc = string.Join("&", p.Where(kv => !string.IsNullOrEmpty(kv.Value))
                          .OrderBy(kv => kv.Key, StringComparer.Ordinal)
                          .Select(kv => $"{kv.Key}={kv.Value}")) + "&key=" + appKey;
var hash = MD5.HashData(Encoding.UTF8.GetBytes(signSrc));
p["sign"] = Convert.ToHexString(hash);   // .NET 5+ 默认输出大写 hex
p["signType"] = "MD5";

var payload = JsonSerializer.SerializeToUtf8Bytes(p,
    new JsonSerializerOptions { Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping });
using var http = new HttpClient();
var resp = await http.PostAsync("https://api.60185.com/api/pay/unifiedOrder",
    new StringContent(Encoding.UTF8.GetString(payload), Encoding.UTF8, "application/json"));
using var doc = JsonDocument.Parse(await resp.Content.ReadAsStringAsync());
// doc.RootElement.GetProperty("code").GetInt32() == 200 即成功；取 data.payEntryUrl 引导付款

复制-- 依赖：luaossl（md5）+ lua-cjson + luasec/http；OpenResty 下用 resty.md5 + resty.http
local md5    = require('resty.openssl.digest')      -- luaossl；OpenResty 也可用 resty.md5（见下方注释）
local cjson  = require('cjson')
local http   = require('http')

local appKey = '你的 appKey'
local p = {
  merchantNo = '88001', appId = 'app_demo',
  mchOrderNo = 'ORD20260928001', payMethod = 'alipay',
  bankCode = '9311',
  amount = '0.01', currency = 'CNY', subject = '测试商品',   -- 单位：元
  notifyUrl = 'https://m.example.com/pay/notify',
  timestamp = tostring(math.floor(ngx and ngx.now() * 1000 or os.time() * 1000)),  -- 毫秒
  nonce = string.format('%08x%08x', math.random(0, 0xffffffff), math.random(0, 0xffffffff)),
}

-- 非空参数按 key ASCII（字节序）升序 → k=v&... → 尾随 &key=appKey → MD5 大写
local keys = {}
for k, v in pairs(p) do if v ~= nil and v ~= '' then keys[#keys + 1] = k end end
table.sort(keys)                                                  -- Lua 字符串比较即字节序，等价 ASCII 升序
local parts = {}
for _, k in ipairs(keys) do parts[#parts + 1] = k .. '=' .. tostring(p[k]) end
local signSrc = table.concat(parts, '&') .. '&key=' .. appKey

local function md5Upper(s)
  local d = md5.new('md5'); d:update(s)
  return (d:final():gsub('.', function(c) return string.format('%02X', c) end))   -- 大写 hex
end
p.sign     = md5Upper(signSrc)
-- OpenResty 写法： local m = require('resty.md5'); m:set(signSrc); p.sign = string.upper(m:tohex())
p.signType = 'MD5'

local res, err = http.post('https://api.60185.com/api/pay/unifiedOrder', cjson.encode(p),
                           { ['Content-Type'] = 'application/json' })
if not res then error(err) end
local out = cjson.decode(res)     -- luaossl http 直接返回响应体字符串
-- out.code == 200 即成功；用 out.data.payEntryUrl 引导用户打开付款
-- 注：luaossl/cjson 为阻塞调用，适合普通 Lua 脚本；OpenResty 网关内请改用 resty.http + cjson

复制{
  "code": 200,
  "msg": "success",
  "data": {
    "orderId": "P20260928000001",       // 平台订单号
    "mchOrderNo": "ORD20260928001",
    "merchantNo": "88001",
    "appId": "app_demo",
    "payMethod": "alipay",
    "amount": 0.01,                     // 元
    "currency": "CNY",
    "status": 0,                        // 0待支付 1支付中 2成功 3失败 4已退款 5部分退款 6已关闭
    "payEntryUrl": "https://api.60185.com/risk/loading?...",  // ★风控入口，必须引导用户打开
    "payData": "https://qr.alipay.com/xxx",   // 收银台URL/二维码内容(服务端留存)
    "expireTime": "2026-09-28 17:44:19",
    "traceId": "a1b2c3...",
    "routingStatus": null               // busy/none 仅入金账户异常时透出
  }
}

复制{
  "code": 0,
  "msg": "SUCCESS",
  "data": {
    "payOrderId": "P20260928000001",   // 平台订单号
    "mchOrderNo": "ORD20260928001",
    "mchNo": "88001",
    "wayCode": "ALI_QR",
    "amount": 1,
    "currency": "cny",
    "state": 1,                         // 见 state 表，2=成功
    "orderId": "2026...CHN",            // 通道订单号
    "channelOrderNo": "2026...CHN",
    "payData": "https://qr.alipay.com/xxx",
    "payUrl": "https://qr.alipay.com/xxx",
    "payDataType": "url_scheme",        // 或 qr_content(二维码内容)
    "errMsg": ""
  }
}

页面跳转支付 GET/POST /api/epay/submit.php

参数与 mapi.php 完全相同，用于传统“表单自动提交跳转到收银台”。商户页面构造一个 form 自动 POST 即可：

复制<form id="epay" method="post" action="https://api.60185.com/api/epay/submit.php">
  <input name="pid" value="1001">
  <input name="type" value="alipay">
  <input name="out_trade_no" value="ORD001">
  <input name="notify_url" value="https://m.example.com/notify">
  <input name="return_url" value="https://m.example.com/return">
  <input name="name" value="test">
  <input name="money" value="0.01">
  <input name="sign" value="{小写MD5}">
  <input name="sign_type" value="MD5">
</form><script>epay.submit()</script>

查询 GET /api/epay/api.php

① 查商户信息

复制GET /api/epay/api.php?act=query&pid=1001&key={KEY}
// → { "code":1, "pid":1001, "key":"...", "active":1, "money":"余额" }

② 查订单

复制GET /api/epay/api.php?pid=1001&key={KEY}&out_trade_no=ORD001
// 或传 trade_no=P20260928000009
// → { "trade_no","out_trade_no","type","pid","addtime","endtime","name","money","status":1 }
// status: 1=已支付  0=未支付

复制POST {notifyUrl}   Content-Type: application/json
{
  "payOrderId": "P20260928000001",   // 平台订单号
  "mchOrderNo": "ORD20260928001",     // 商户订单号
  "mchNo": "88001", "appId": "app_demo",
  "wayCode": "ALI_QR",
  "payAmount": "1",                    // 金额，单位分
  "currency": "cny",
  "state": "2",                        // 2=支付成功
  "orderId": "2026...CHN", "channelOrderNo": "2026...CHN",
  "subject": "测试商品", "body": "",
  "paySuccTime": "2026-09-28 15:44:19", "createTime": "...",
  "extParam": "",
  "signType": "MD5",
  "sign": "5F3A...大写MD5...9C1D"
}

验签：把除 sign/signType 外的非空字段按 ASCII 升序拼 k=v&…&key={appKey}，MD5 大写 与 sign 比对；再校验 state==2 且 payAmount 与本地订单金额一致才入账。验签通过后仍须调查单接口确认状态，不得仅凭通知入账。

复制POST {notify_url}   Content-Type: application/json
{
  "trade_no": "P20260928000009",      // 平台订单号
  "out_trade_no": "ORD001",           // 商户订单号
  "type": "alipay",
  "pid": "1001",
  "trade_status": "TRADE_SUCCESS",    // 支付成功
  "money": "0.01",                     // 金额，单位元
  "param": "",
  "sign": "a1b2...小写MD5...f9e8",
  "sign_type": "MD5"
}

验签（易支付）：除 sign/sign_type 外的非空字段 ASCII 升序拼 k=v&… 后直接拼 KEY（无 &key=），MD5 小写。校验 trade_status==TRADE_SUCCESS 且 money 与订单一致。

流程节点 flowNode：0 发起 → 1 进入风控 → 2 领取支付链接 → 3 已付款（单调递增，用于观测用户推进到哪一步）。接口成功码 code=200；支付最终结果必须以查单接口为准，异步通知仅作触发（见 异步通知）。

微信 JSAPI/小程序（WX_JSAPI / WX_LITE）需传 channelId=用户 openid。

易支付：金额单位元（字符串），签名 MD5 小写、密钥裸拼；详见 易支付接口。