商户 API 文档

// Java(后端,使用 OkHttp + Jackson)
String apiKey    = "YOUR_API_KEY";
String apiSecret = "YOUR_API_SECRET";
String baseUrl   = "https://api2.iqingchuan.com";
String path      = "/api/v1/order/create";

Map<String,Object> params = new HashMap<>();
params.put("merchant_order_no", "MYORDER_" + System.currentTimeMillis());
params.put("amount", "10.00");
params.put("client_user_id", "user_123");
params.put("notify_url", "https://yoursite.com/cb");

ObjectMapper mapper = new ObjectMapper();
String body = mapper.writeValueAsString(params);

String ts    = String.valueOf(System.currentTimeMillis() / 1000);
String nonce = UUID.randomUUID().toString().replace("-", "");
String msg   = ts + "\n" + nonce + "\nPOST\n" + path + "\n" + body;
String sig   = HmacUtils.hmacSha256Hex(apiSecret, msg);

Request req = new Request.Builder()
    .url(baseUrl + path)
    .post(RequestBody.create(body, MediaType.parse("application/json")))
    .addHeader("X-Api-Key",    apiKey)
    .addHeader("X-Timestamp",  ts)
    .addHeader("X-Nonce",      nonce)
    .addHeader("X-Signature",  sig)
    .build();

OkHttpClient client = new OkHttpClient();
try (Response resp = client.newCall(req).execute()) {
    System.out.println(resp.body().string());
}

import time, uuid, json, hmac, hashlib, requests

API_KEY    = "YOUR_API_KEY"
API_SECRET = "YOUR_API_SECRET"
BASE_URL   = "https://api2.iqingchuan.com"
PATH       = "/api/v1/order/create"

body = json.dumps({
    "merchant_order_no": "MYORDER_" + str(int(time.time())),
    "amount": "10.00",
    "client_user_id": "user_123",
    "notify_url": "https://yoursite.com/cb",
}, separators=(",", ":"))

ts    = str(int(time.time()))
nonce = uuid.uuid4().hex
msg   = f"{ts}\n{nonce}\nPOST\n{PATH}\n{body}"
sig   = hmac.new(API_SECRET.encode(), msg.encode(), hashlib.sha256).hexdigest()

resp = requests.post(
    BASE_URL + PATH,
    data=body,
    headers={
        "Content-Type": "application/json",
        "X-Api-Key":    API_KEY,
        "X-Timestamp":  ts,
        "X-Nonce":      nonce,
        "X-Signature":  sig,
    },
    timeout=15,
)
print(resp.json())

// Node.js(使用原生 https + crypto,无需第三方依赖)
const crypto = require("crypto");
const https  = require("https");

const API_KEY    = "YOUR_API_KEY";
const API_SECRET = "YOUR_API_SECRET";
const PATH       = "/api/v1/order/create";

const bodyObj = {
    merchant_order_no: "MYORDER_" + Date.now(),
    amount: "10.00",
    client_user_id: "user_123",
    notify_url: "https://yoursite.com/cb",
};
const body = JSON.stringify(bodyObj);

const ts    = Math.floor(Date.now() / 1000).toString();
const nonce = crypto.randomBytes(16).toString("hex");
const msg   = `${ts}\n${nonce}\nPOST\n${PATH}\n${body}`;
const sig   = crypto.createHmac("sha256", API_SECRET).update(msg).digest("hex");

const req = https.request({
    host: "api2.iqingchuan.com",
    path: PATH,
    method: "POST",
    headers: {
        "Content-Type": "application/json",
        "X-Api-Key":    API_KEY,
        "X-Timestamp":  ts,
        "X-Nonce":      nonce,
        "X-Signature":  sig,
    },
}, (res) => {
    let chunks = "";
    res.on("data", c => chunks += c);
    res.on("end", () => console.log(JSON.parse(chunks)));
});
req.write(body); req.end();

String path = "/api/v1/order/query?platform_order_no=PAY202608110001";
String body = "";

String ts    = String.valueOf(System.currentTimeMillis() / 1000);
String nonce = UUID.randomUUID().toString().replace("-", "");
String msg   = ts + "\n" + nonce + "\nGET\n" + path + "\n" + body;
String sig   = HmacUtils.hmacSha256Hex(apiSecret, msg);

Request req = new Request.Builder()
    .url("https://api2.iqingchuan.com" + path)
    .get()
    .addHeader("X-Api-Key",   apiKey)
    .addHeader("X-Timestamp", ts)
    .addHeader("X-Nonce",     nonce)
    .addHeader("X-Signature", sig)
    .build();

OkHttpClient client = new OkHttpClient();
try (Response resp = client.newCall(req).execute()) {
    System.out.println(resp.body().string());
}

import time, uuid, hmac, hashlib, requests

API_KEY    = "YOUR_API_KEY"
API_SECRET = "YOUR_API_SECRET"
PATH       = "/api/v1/order/query"
QUERY      = "platform_order_no=PAY202608110001"
FULL_PATH  = f"{PATH}?{QUERY}"
body       = ""   # GET 签名 body 必须是空字符串

ts    = str(int(time.time()))
nonce = uuid.uuid4().hex
msg   = f"{ts}\n{nonce}\nGET\n{FULL_PATH}\n{body}"
sig   = hmac.new(API_SECRET.encode(), msg.encode(), hashlib.sha256).hexdigest()

resp = requests.get(
    "https://api2.iqingchuan.com" + FULL_PATH,
    headers={
        "X-Api-Key":   API_KEY,
        "X-Timestamp": ts,
        "X-Nonce":     nonce,
        "X-Signature": sig,
    },
    timeout=15,
)
print(resp.json())

const crypto = require("crypto");
const https  = require("https");

const API_KEY    = "YOUR_API_KEY";
const API_SECRET = "YOUR_API_SECRET";
const QUERY      = "platform_order_no=PAY202608110001";
const FULL_PATH  = "/api/v1/order/query?" + QUERY;
const body       = "";

const ts    = Math.floor(Date.now() / 1000).toString();
const nonce = crypto.randomBytes(16).toString("hex");
const msg   = `${ts}\n${nonce}\nGET\n${FULL_PATH}\n${body}`;
const sig   = crypto.createHmac("sha256", API_SECRET).update(msg).digest("hex");

https.get({
    host: "api2.iqingchuan.com",
    path: FULL_PATH,
    headers: {
        "X-Api-Key":   API_KEY,
        "X-Timestamp": ts,
        "X-Nonce":     nonce,
        "X-Signature": sig,
    },
}, (res) => {
    let chunks = "";
    res.on("data", c => chunks += c);
    res.on("end", () => console.log(JSON.parse(chunks)));
});

// body 仅含 platform_order_no,其它头部同 /order/create

body = json.dumps({"platform_order_no": "PAY202608110001"})
# 头部构造与 /order/create 一致,仅 path 与 body 不同

// body 仅含 platform_order_no,头部构造与 /order/create 一致