接口说明及规范

/**
 * 生成待签名字符串并按 ASCII 升序排序
 * @param array $params 业务参数（不含 sign / sign_type）
 */
function buildSignSource(array $params): string
{
    // 1. 剔除 sign、sign_type 与空值
    unset($params['sign'], $params['sign_type']);
    $params = array_filter($params, function ($v) {
        return $v !== '' && $v !== null;
    });

    // 2. 按键名 ASCII 升序排序
    ksort($params, SORT_STRING);

    // 3. 拼接成 参数=参数值&参数=参数值
    $pairs = [];
    foreach ($params as $k => $v) {
        $pairs[] = $k . '=' . $v;
    }
    return implode('&', $pairs);
}

/** SHA256WithRSA 签名，返回 Base64 字符串 */
function rsaSign(array $params, string $merchantPrivateKey): string
{
    $source = buildSignSource($params);
    openssl_sign($source, $sign, $merchantPrivateKey, OPENSSL_ALGO_SHA256);
    return base64_encode($sign);
}

/** 平台公钥验签 */
function rsaVerify(array $params, string $sign, string $platformPublicKey): bool
{
    $source = buildSignSource($params);
    return openssl_verify($source, base64_decode($sign), $platformPublicKey, OPENSSL_ALGO_SHA256) === 1;
}

import java.security.*;
import java.security.spec.*;
import java.util.*;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

public class SignUtil {
    public static String buildSource(Map<String, String> params) {
        params.remove("sign");
        params.remove("sign_type");
        TreeMap<String, String> sorted = new TreeMap<>();
        for (Map.Entry<String, String> e : params.entrySet()) {
            String v = e.getValue();
            if (v != null && !v.isEmpty()) sorted.put(e.getKey(), v);
        }
        StringBuilder sb = new StringBuilder();
        for (Map.Entry<String, String> e : sorted.entrySet()) {
            if (sb.length() > 0) sb.append('&');
            sb.append(e.getKey()).append('=').append(e.getValue());
        }
        return sb.toString();
    }

    public static String sign(Map<String, String> params, String privateKey) throws Exception {
        Signature signature = Signature.getInstance("SHA256withRSA");
        signature.initSign(loadPrivateKey(privateKey));
        signature.update(buildSource(params).getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(signature.sign());
    }
}

import base64
from urllib.parse import urlencode

def build_source(params: dict) -> str:
    """剔除 sign / sign_type 与空值，按 ASCII 升序拼接"""
    data = {k: v for k, v in params.items()
            if k not in ("sign", "sign_type") and v not in (None, "")}
    return urlencode(sorted(data.items()))

def rsa_sign(params: dict, merchant_private_key: str) -> str:
    """SHA256WithRSA 签名（依赖 cryptography）"""
    from cryptography.hazmat.primitives import hashes, serialization
    from cryptography.hazmat.primitives.asymmetric import padding

    key = serialization.load_pem_private_key(merchant_private_key.encode(), password=None)
    signature = key.sign(build_source(params).encode("utf-8"),
                         padding.PKCS1v15(), hashes.SHA256())
    return base64.b64encode(signature).decode()

def rsa_verify(params: dict, sign: str, platform_public_key: str) -> bool:
    from cryptography.hazmat.primitives import hashes, serialization
    from cryptography.hazmat.primitives.asymmetric import padding
    from cryptography.exceptions import InvalidSignature

    key = serialization.load_pem_public_key(platform_public_key.encode())
    try:
        key.verify(base64.b64decode(sign), build_source(params).encode("utf-8"),
                   padding.PKCS1v15(), hashes.SHA256())
        return True
    except InvalidSignature:
        return False

<!-- 页面跳转支付：表单自动提交 -->
<form id="payForm" action="https://pay.ya92.com/api/pay/submit" method="post">
    <input type="hidden" name="pid" value="1001">
    <input type="hidden" name="type" value="alipay">
    <input type="hidden" name="out_trade_no" value="20160806151343349">
    <input type="hidden" name="notify_url" value="http://www.pay.com/notify_url.php">
    <input type="hidden" name="return_url" value="http://www.pay.com/return_url.php">
    <input type="hidden" name="name" value="VIP会员">
    <input type="hidden" name="money" value="1.00">
    <input type="hidden" name="timestamp" value="1721206072">
    <input type="hidden" name="sign" value="商户私钥签名结果">
    <input type="hidden" name="sign_type" value="RSA">
</form>
<script>document.getElementById('payForm').submit();</script>

$params = [
    'pid'           => 1001,
    'type'          => 'alipay',
    'out_trade_no'  => '20160806151343349',
    'notify_url'    => 'http://www.pay.com/notify_url.php',
    'return_url'    => 'http://www.pay.com/return_url.php',
    'name'          => 'VIP会员',
    'money'         => '1.00',
    'timestamp'     => (string) time(),
];
$params['sign']      = rsaSign($params, $merchantPrivateKey);
$params['sign_type'] = 'RSA';

// 方式一：服务端渲染自动提交表单
echo '<form id="f" method="post" action="https://pay.ya92.com/api/pay/submit">';
foreach ($params as $k => $v) {
    echo '<input type="hidden" name="' . htmlspecialchars($k) . '" value="' . htmlspecialchars($v) . '">';
}
echo '</form><script>document.getElementById("f").submit();</script>';

// 方式二：直接拼接 URL 跳转（GET）
// header('Location: https://pay.ya92.com/api/pay/submit?' . http_build_query($params));

curl -X POST 'https://pay.ya92.com/api/pay/submit' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'pid=1001' \
  --data-urlencode 'type=alipay' \
  --data-urlencode 'out_trade_no=20160806151343349' \
  --data-urlencode 'notify_url=http://www.pay.com/notify_url.php' \
  --data-urlencode 'return_url=http://www.pay.com/return_url.php' \
  --data-urlencode 'name=VIP会员' \
  --data-urlencode 'money=1.00' \
  --data-urlencode 'timestamp=1721206072' \
  --data-urlencode 'sign=商户私钥签名结果' \
  --data-urlencode 'sign_type=RSA'

{
    "code": 0,
    "trade_no": "20160806151343349",
    "pay_type": "qrcode",
    "pay_info": "weixin://wxpay/bizpayurl?pr=04IPMKM"
}

{
    "code": 0,
    "trade_no": "20160806151343349",
    "pay_type": "jump",
    "pay_info": "https://qr.alipay.com/bax00000"
}

{
    "code": 0,
    "trade_no": "20160806151343351",
    "pay_type": "jsapi",
    "pay_info": "{\"appId\":\"wx2421b1c4370ec43b\",\"timeStamp\":\"1395712654\",\"nonceStr\":\"e61463f8efa94090b1f366cccfbbb444\",\"package\":\"prepay_id=up_wx21201855730335ac86f8c43d1889123400\",\"signType\":\"RSA\",\"paySign\":\"oR9d8PuhnIc+YZ8cBHFCwfgpaK9gd7vaRvkYD7rthRAZ\"}"
}

{
    "code": 0,
    "trade_no": "2024072320222180092",
    "pay_type": "scan",
    "pay_info": "{\"type\":\"wxpay\",\"trade_no\":\"2024072320222180092\",\"api_trade_no\":\"4200002345202407238253501450\",\"buyer\":\"o9uAcc6VlZxhcujpKIqQuWWoDQc\",\"money\":\"1.00\"}"
}

$params = [
    'pid'          => 1001,
    'method'       => 'jump',          // 直接返回跳转 url，最简单
    'type'         => 'alipay',
    'out_trade_no' => '20160806151343349',
    'notify_url'   => 'http://www.pay.com/notify_url.php',
    'return_url'   => 'http://www.pay.com/return_url.php',
    'name'         => 'VIP会员',
    'money'        => '1.00',
    'clientip'     => '192.168.1.100',
    'timestamp'    => (string) time(),
];
$params['sign']      = rsaSign($params, $merchantPrivateKey);
$params['sign_type'] = 'RSA';

$ch = curl_init('https://pay.ya92.com/api/pay/create');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => http_build_query($params),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
]);
$resp = curl_exec($ch);
curl_close($ch);

$result = json_decode($resp, true);
if (($result['code'] ?? -1) === 0 && rsaVerify($result, $result['sign'], $platformPublicKey)) {
    header('Location: ' . $result['pay_info']);   // pay_type = jump
    exit;
}
exit('下单失败：' . ($result['msg'] ?? '未知错误'));

Map<String, String> params = new HashMap<>();
params.put("pid", "1001");
params.put("method", "jump");
params.put("type", "alipay");
params.put("out_trade_no", "20160806151343349");
params.put("notify_url", "http://www.pay.com/notify_url.php");
params.put("name", "VIP会员");
params.put("money", "1.00");
params.put("clientip", "192.168.1.100");
params.put("timestamp", String.valueOf(System.currentTimeMillis() / 1000));
params.put("sign", SignUtil.sign(params, merchantPrivateKey));
params.put("sign_type", "RSA");

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://pay.ya92.com/api/pay/create"))
        .header("Content-Type", "application/x-www-form-urlencoded")
        .POST(HttpRequest.BodyPublishers.ofString(toForm(params)))
        .build();
String body = client.send(request, HttpResponse.BodyHandlers.ofString()).body();

import json, time, requests

params = {
    "pid": 1001,
    "method": "jump",
    "type": "alipay",
    "out_trade_no": "20160806151343349",
    "notify_url": "http://www.pay.com/notify_url.php",
    "name": "VIP会员",
    "money": "1.00",
    "clientip": "192.168.1.100",
    "timestamp": str(int(time.time())),
}
params["sign"] = rsa_sign(params, merchant_private_key)
params["sign_type"] = "RSA"

resp = requests.post("https://pay.ya92.com/api/pay/create", data=params, timeout=15)
result = resp.json()
assert rsa_verify(result, result["sign"], platform_public_key), "验签失败"
print(result["pay_info"])   # 跳转地址

const crypto = require('crypto');
const axios = require('axios');

function buildSource(params) {
  const obj = {};
  Object.keys(params).forEach(k => {
    if (k === 'sign' || k === 'sign_type') return;
    if (params[k] === '' || params[k] === null) return;
    obj[k] = String(params[k]);
  });
  return Object.keys(obj).sort()
    .map(k => `${k}=${obj[k]}`).join('&');
}

const params = {
  pid: 1001, method: 'jump', type: 'alipay',
  out_trade_no: '20160806151343349',
  notify_url: 'http://www.pay.com/notify_url.php',
  name: 'VIP会员', money: '1.00',
  clientip: '192.168.1.100',
  timestamp: String(Math.floor(Date.now() / 1000)),
};
params.sign = crypto.sign('sha256', Buffer.from(buildSource(params)),
                          merchantPrivateKey).toString('base64');
params.sign_type = 'RSA';

const { data } = await axios.post('https://pay.ya92.com/api/pay/create',
      new URLSearchParams(params).toString(), { timeout: 15000 });
console.log(data.pay_info);

curl -X POST 'https://pay.ya92.com/api/pay/create' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'pid=1001' \
  -d 'method=jump' \
  -d 'type=alipay' \
  -d 'out_trade_no=20160806151343349' \
  -d 'notify_url=http://www.pay.com/notify_url.php' \
  -d 'name=VIP会员' \
  -d 'money=1.00' \
  -d 'clientip=192.168.1.100' \
  -d 'timestamp=1721206072' \
  -d 'sign=商户私钥签名结果' \
  -d 'sign_type=RSA'

$params = [
    'pid'          => 1001,
    'out_trade_no' => '20160806151343349',
    'timestamp'    => (string) time(),
];
$params['sign']      = rsaSign($params, $merchantPrivateKey);
$params['sign_type'] = 'RSA';

$ch = curl_init('https://pay.ya92.com/api/pay/query');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => http_build_query($params),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

if ($result['code'] === 0 && $result['status'] == 1) {
    // 订单已支付，可在此发货
    echo '已支付，金额：' . $result['money'];
}

curl -X POST 'https://pay.ya92.com/api/pay/query' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'pid=1001' \
  -d 'out_trade_no=20160806151343349' \
  -d 'timestamp=1721206072' \
  -d 'sign=商户私钥签名结果' \
  -d 'sign_type=RSA'

/** V1 旧版 MD5 签名 */
function epaySign(array $params, string $key): string
{
    // 1. 剔除 sign / sign_type 与空值
    unset($params['sign'], $params['sign_type']);
    $params = array_filter($params, function ($v) {
        return $v !== '' && $v !== null;
    });

    // 2. 键名 ASCII 升序
    ksort($params, SORT_STRING);

    // 3. 拼接成 k=v&k=v（值不做 URL 编码）后与密钥一起 md5
    $pairs = [];
    foreach ($params as $k => $v) {
        $pairs[] = $k . '=' . $v;
    }
    return strtolower(md5(implode('&', $pairs) . $key));
}

import hashlib
from urllib.parse import quote

def epay_sign(params: dict, key: str) -> str:
    """V1 旧版 MD5 签名"""
    data = {k: v for k, v in params.items()
            if k not in ("sign", "sign_type") and v not in (None, "")}
    source = "&".join(f"{k}={v}" for k, v in sorted(data.items()))
    return hashlib.md5((source + key).encode("utf-8")).hexdigest()

<!-- V1 页面跳转支付：表单自动提交 -->
<form id="payForm" action="https://pay.ya92.com/submit.php" method="post">
    <input type="hidden" name="pid" value="1001">
    <input type="hidden" name="type" value="alipay">
    <input type="hidden" name="out_trade_no" value="20160806151343349">
    <input type="hidden" name="notify_url" value="http://www.pay.com/notify_url.php">
    <input type="hidden" name="return_url" value="http://www.pay.com/return_url.php">
    <input type="hidden" name="name" value="VIP会员">
    <input type="hidden" name="money" value="1.00">
    <input type="hidden" name="sign" value="MD5 签名结果">
    <input type="hidden" name="sign_type" value="MD5">
</form>
<script>document.getElementById('payForm').submit();</script>

$params = [
    'pid'          => '1001',
    'type'         => 'alipay',
    'out_trade_no' => '20160806151343349',
    'notify_url'   => 'http://www.pay.com/notify_url.php',
    'return_url'   => 'http://www.pay.com/return_url.php',
    'name'         => 'VIP会员',
    'money'        => '1.00',
];
$params['sign']      = epaySign($params, $merchantKey);
$params['sign_type'] = 'MD5';

echo '<form id="f" method="post" action="https://pay.ya92.com/submit.php">';
foreach ($params as $k => $v) {
    echo '<input type="hidden" name="' . htmlspecialchars($k) . '" value="' . htmlspecialchars($v) . '">';
}
echo '</form><script>document.getElementById("f").submit();</script>';

$params = [
    'pid'          => '1001',
    'type'         => 'alipay',
    'out_trade_no' => '20160806151343349',
    'notify_url'   => 'http://www.pay.com/notify_url.php',
    'return_url'   => 'http://www.pay.com/return_url.php',
    'name'         => 'VIP会员',
    'money'        => '1.00',
    'clientip'     => '192.168.1.100',
];
$params['sign']      = epaySign($params, $merchantKey);
$params['sign_type'] = 'MD5';

$ch = curl_init('https://pay.ya92.com/mapi.php');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => http_build_query($params),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

if (($result['code'] ?? 0) == 1) {
    if (!empty($result['payurl'])) {
        header('Location: ' . $result['payurl']);        // 直接跳转支付
    } elseif (!empty($result['qrcode'])) {
        // 用 $result['qrcode'] 生成二维码给用户扫
    } elseif (!empty($result['urlscheme'])) {
        // 小程序场景：用 JS 跳转 $result['urlscheme']
    }
} else {
    exit('下单失败：' . ($result['msg'] ?? '未知错误'));
}

curl -X POST 'https://pay.ya92.com/mapi.php' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'pid=1001' \
  -d 'type=alipay' \
  -d 'out_trade_no=20160806151343349' \
  -d 'notify_url=http://www.pay.com/notify_url.php' \
  -d 'name=VIP会员' \
  -d 'money=1.00' \
  -d 'clientip=192.168.1.100' \
  -d 'sign=MD5签名结果' \
  -d 'sign_type=MD5'