USNpay API 文档

function cpRequest($method, $path, $body, $cfg) {
    $ts = time();
    $json = $body ? json_encode($body, JSON_UNESCAPED_SLASHES) : '';
    $payload = strtoupper($method) . "\n" . $path . "\n" . $ts . "\n" . $json;
    $sig = hash_hmac('sha256', $payload, $cfg['secret']);

    $ch = curl_init($cfg['base'] . $path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_POSTFIELDS    => $json,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => [
            "X-Merchant-Id: " . $cfg['merchant'],
            "X-Api-Key: " . $cfg['apikey'],
            "X-Timestamp: " . $ts,
            "X-Signature: " . $sig,
            "Content-Type: application/json",
        ],
    ]);
    return json_decode(curl_exec($ch), true);
}

import time, json, hmac, hashlib, requests

def cp_request(method, path, body, cfg):
    ts = str(int(time.time()))
    raw = json.dumps(body, separators=(',', ':')) if body else ''
    payload = f"{method.upper()}\n{path}\n{ts}\n{raw}"
    sig = hmac.new(
        cfg['secret'].encode(), payload.encode(), hashlib.sha256
    ).hexdigest()

    headers = {
        'X-Merchant-Id': cfg['merchant'],
        'X-Api-Key': cfg['apikey'],
        'X-Timestamp': ts,
        'X-Signature': sig,
        'Content-Type': 'application/json',
    }
    return requests.request(method, cfg['base'] + path, headers=headers, data=raw).json()

const crypto = require('crypto');

async function cpRequest(method, path, body, cfg) {
  const ts = String(Math.floor(Date.now() / 1000));
  const raw = body ? JSON.stringify(body) : '';
  const payload = `${method.toUpperCase()}\n${path}\n${ts}\n${raw}`;
  const sig = crypto.createHmac('sha256', cfg.secret)
    .update(payload).digest('hex');

  const res = await fetch(cfg.base + path, {
    method,
    headers: {
      'X-Merchant-Id': cfg.merchant,
      'X-Api-Key': cfg.apikey,
      'X-Timestamp': ts,
      'X-Signature': sig,
      'Content-Type': 'application/json',
    },
    body: raw || undefined,
  });
  return res.json();
}

@app.route('/callback', methods=['POST'])
def callback():
    raw = request.get_data()
    sig = request.headers.get('X-ChainPay-Signature', '')
    expected = hmac.new(
        webhook_secret.encode(), raw, hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(expected, sig):
        return 'invalid', 401
    data = request.get_json()
    # 更新本地订单
    return 'ok', 200

app.post('/callback', express.raw({type:'*/*'}), (req, res) => {
  const raw = req.body; // Buffer
  const sig = req.headers['x-chainpay-signature'];
  const expected = crypto.createHmac('sha256', webhookSecret)
    .update(raw).digest('hex');
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig)))
    return res.status(401).send('invalid');
  const data = JSON.parse(raw.toString());
  // 更新本地订单
  res.send('ok');
});