签名规则

attach=test&partner_request_no=REQ20240520001&pid=DEMO20240001&target_amount=50.00&key=渠道密钥

1. 统一下单

2. 订单查询

3. 退款申请

4. 可售商品列表

5. 订单列表

6. 默认通知地址配置

7. 平台异步通知（平台 → 渠道）

8. 常见失败提示

9. 签名与下单示例

PHP

<?php
function sign(array $params, string $secret): string {
    unset($params['sign'], $params['sign_type']);
    $params = array_filter($params, fn($v) => $v !== null && $v !== '');
    ksort($params);                       // ASCII 升序
    $str = urldecode(http_build_query($params)); // k=v&k2=v2
    return md5($str . $secret);
}

$params = [
  'pid' => 'DEMO20240001',
  'partner_request_no' => 'REQ' . date('YmdHis'),
  'partner_user_id' => 'U10086',
  // 方式A：不指定商品，由平台按金额匹配——target_amount 必须参与签名
  'target_amount' => '50.00',
  // 方式B：也可改用 'sku_id' => '1' 精确指定商品
  'quantity' => '1',
  'attach' => 'campaign_a',
];
$params['sign'] = sign($params, '渠道密钥');

$ch = curl_init('https://你的域名/api/partner/order/create');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_POSTFIELDS => http_build_query($params),
  CURLOPT_RETURNTRANSFER => true,
]);
$res = json_decode(curl_exec($ch), true);
header('Location: ' . $res['data']['cashier_url']); // 或 pay_url

Java

import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.*;

public class PartnerSign {
    static String sign(Map<String,String> p, String secret) throws Exception {
        var keys = new TreeSet<>(p.keySet());          // ASCII 升序
        var sb = new StringBuilder();
        for (String k : keys) {
            if (k.equals("sign") || k.equals("sign_type")) continue;
            String v = p.get(k);
            if (v == null || v.isEmpty()) continue;
            if (sb.length() > 0) sb.append('&');
            sb.append(k).append('=').append(v);        // 值不做URLEncode
        }
        sb.append(secret);
        var md = MessageDigest.getInstance("MD5");
        byte[] b = md.digest(sb.toString().getBytes(StandardCharsets.UTF_8));
        var hex = new StringBuilder();
        for (byte x : b) hex.append(String.format("%02x", x));
        return hex.toString();
    }
}

Python

import hashlib, time, requests

def sign(params: dict, secret: str) -> str:
    items = [(k, v) for k, v in params.items()
             if k not in ("sign", "sign_type") and v not in (None, "")]
    items.sort(key=lambda x: x[0])               # ASCII 升序
    raw = "&".join(f"{k}={v}" for k, v in items)
    return hashlib.md5((raw + secret).encode("utf-8")).hexdigest()

params = {
    "pid": "DEMO20240001",
    "partner_request_no": f"REQ{int(time.time())}",
    "partner_user_id": "U10086",
    # 不指定商品，平台按金额匹配最接近的商品；target_amount 必须参与签名
    "target_amount": "50.00",
}
params["sign"] = sign(params, "渠道密钥")

r = requests.post("https://你的域名/api/partner/order/create", data=params, timeout=10)
print(r.json()["data"]["cashier_url"])

验签（渠道收到异步通知时，以 Node.js 为例）

const crypto = require('crypto');
function verifyNotify(params, secret) {
  const given = params.sign;
  const items = Object.keys(params)
    .filter(k => !['sign', 'sign_type'].includes(k) && params[k] !== '')
    .sort().map(k => `${k}=${params[k]}`);
  const expected = crypto.createHash('md5')
    .update(items.join('&') + secret).digest('hex');
  return given === expected;
}
// 验签通过且 trade_status === 'TRADE_SUCCESS' 后，响应字符串 success