支付接口开发文档

// 待签名参数（已剔除 sign / sign_type / 空值，并按 ASCII 升序）
money=9.90&name=VIP会员&notify_url=https://demo.com/notify.php&out_trade_no=202610270001&pid=1001&return_url=https://demo.com/return.php&type=alipay

// 拼接商户密钥（假设 key 为 abcd1234）后取 MD5
sign = md5("money=9.90&name=VIP会员&...&type=alipayabcd1234")

openssl genrsa -out merchant_private.pem 2048
openssl rsa -in merchant_private.pem -pubout -out merchant_public.pem
# 把 merchant_public.pem 的内容粘贴到后台「商户公钥」，merchant_private.pem 自己保存

function rsaSign(array $params, $privateKeyPem) {
    // 1. 排序 + 剔除 sign / sign_type / 空值
    ksort($params);
    $str = '';
    foreach ($params as $k => $v) {
        if ($k=='sign' || $k=='sign_type' || $v==='' || is_array($v)) continue;
        $str .= $k.'='.$v.'&';
    }
    $str = rtrim($str, '&');
    // 2. SHA256withRSA 签名 + base64
    $pkey = openssl_pkey_get_private($privateKeyPem);
    openssl_sign($str, $sign, $pkey, OPENSSL_ALGO_SHA256);
    return base64_encode($sign);
}
$params['sign_type'] = 'RSA';
$params['sign']      = rsaSign($params, $merchantPrivateKey);

import hashlib, base64
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.serialization import load_pem_private_key

def rsa_sign(params: dict, private_key_pem: str) -> str:
    p = {k: v for k, v in params.items()
         if k not in ('sign', 'sign_type') and v != '' and not isinstance(v, (list, dict))}
    s = '&'.join(f'{k}={p[k]}' for k in sorted(p))
    key = load_pem_private_key(private_key_pem.encode(), password=None)
    sig = key.sign(s.encode(), padding.PKCS1v15(), hashes.SHA256())
    return base64.b64encode(sig).decode()

params['sign_type'] = 'RSA'
params['sign']      = rsa_sign(params, merchant_private_key)

function rsaVerify(array $data, $platformPublicKey) {
    if (!isset($data['sign'])) return false;
    ksort($data);
    $str = '';
    foreach ($data as $k => $v) {
        if ($k=='sign' || $k=='sign_type' || $v==='' || is_array($v)) continue;
        $str .= $k.'='.$v.'&';
    }
    $str = rtrim($str, '&');
    $pkey = openssl_pkey_get_public($platformPublicKey);
    return openssl_verify($str, base64_decode($data['sign']), $pkey, OPENSSL_ALGO_SHA256) === 1;
}

from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding, rsa
from cryptography.hazmat.primitives.serialization import load_pem_public_key

def rsa_verify(data: dict, platform_public_key: str) -> bool:
    d = {k: v for k, v in data.items()
         if k not in ('sign', 'sign_type') and v != '' and not isinstance(v, (list, dict))}
    s = '&'.join(f'{k}={d[k]}' for k in sorted(d))
    key = load_pem_public_key(platform_public_key.encode())
    try:
        key.verify(base64.b64decode(data['sign']), s.encode(),
                   padding.PKCS1v15(), hashes.SHA256())
        return True
    except Exception:
        return False

<!-- 组装参数并计算 sign 后，以 GET 跳转或 POST 表单提交 -->
<form method="post" action="https://pay.yunpay.site/submit.php">
  <input type="hidden" name="pid"          value="1001">
  <input type="hidden" name="type"         value="alipay">
  <input type="hidden" name="out_trade_no" value="202610270001">
  <input type="hidden" name="notify_url"   value="https://demo.com/notify.php">
  <input type="hidden" name="return_url"   value="https://demo.com/return.php">
  <input type="hidden" name="name"         value="VIP会员">
  <input type="hidden" name="money"        value="9.90">
  <input type="hidden" name="sign_type"    value="MD5">
  <input type="hidden" name="sign"         value="{按第 2 节规则计算}">
  <button type="submit">去支付</button>
</form>

{
  "code": 1,
  "trade_no": "2026102714302512345",
  "payurl": "https://bei2.yunpay.site/pay/submit/2026102714302512345/"
}

{
  "code": -2,
  "msg": "用户IP地址(clientip)不能为空"
}

<?php
function getSign($params, $key) {
    ksort($params);
    $str = '';
    foreach ($params as $k => $v) {
        if ($k == 'sign' || $k == 'sign_type' || $v === '') continue;
        $str .= $k . '=' . $v . '&';
    }
    return md5(substr($str, 0, -1) . $key);
}

$params = [
    'pid'          => '1001',
    'type'         => 'alipay',
    'out_trade_no' => '202610270001',
    'notify_url'   => 'https://demo.com/notify.php',
    'return_url'   => 'https://demo.com/return.php',
    'name'         => 'VIP会员',
    'money'        => '9.90',
];
$params['sign_type'] = 'MD5';
$params['sign'] = getSign($params, '你的商户密钥');

// 页面跳转支付：跳转到 submit.php?http_build_query($params)
// API 下单：POST 到 mapi.php，解析返回 JSON 中的 payurl / qrcode

<?php
$sign   = $_GET['sign'];
unset($_GET['sign'], $_GET['sign_type']);

if (getSign($_GET, '你的商户密钥') !== $sign) exit('sign error');
if ($_GET['trade_status'] != 'TRADE_SUCCESS') exit('fail');

// 1) 按订单号查出你的订单  2) 比对金额  3) 幂等发货
// $order = db_query($_GET['out_trade_no']);
// if ($order && $order['status'] == 0 && $order['money'] == $_GET['money']) { mark_paid_and_deliver(); }

echo 'success'; // 只输出 success，其他内容视为失败会触发重试

import hashlib, requests

def get_sign(params, key):
    items = sorted((k, v) for k, v in params.items()
                   if k not in ('sign', 'sign_type') and v != '')
    s = '&'.join(f'{k}={v}' for k, v in items)
    return hashlib.md5((s + key).encode()).hexdigest()

params = {'pid': '1001', 'type': 'alipay', 'out_trade_no': '202610270001',
          'notify_url': 'https://demo.com/notify.php', 'return_url': 'https://demo.com/return.php',
          'name': 'VIP会员', 'money': '9.90',
          'clientip': '1.2.3.4'}  # clientip 为 API 下单必填，填用户真实 IP
params['sign_type'] = 'MD5'
params['sign'] = get_sign(params, '你的商户密钥')

r = requests.post('https://pay.yunpay.site/mapi.php', data=params).json()
print(r.get('payurl') or r.get('qrcode') or r.get('html') or r.get('urlscheme'))