188Pay API 接入文档

curl -X POST https://api2.188pay.top/pay/address \
  -H "Content-Type: application/json" \
  -d '{
    "merchantId": "YOUR_MERCHANT_ID",
    "merchantOrderId": "ORDER_20260220001",
    "amount": 100,
    "coinType": "usdt",
    "notifyUrl": "https://你的网站/callback",
    "sign": "签名值"
  }'

{
  "code": 0,
  "msg": "success",
  "data": {
    "orderId": "20260220143215123456",
    "walletAddress": "TRx1234...abcd",
    "actualAmount": 15.67,
    "expireAt": "2026-02-20T14:52:15.123Z",
    "cashierUrl": "https://api2.188pay.top/cashier?id=20260220143215123456"
  }
}

{
  "code": -1,
  "msg": "错误信息"
}

{
  "code": 0,
  "data": {
    "id": "20260220143215123456",
    "status": "CREATED",
    "terminalReason": null,
    "amount": 100,
    "actualAmount": 15.67,
    "coinType": "usdt",
    "walletAddress": "TRx1234...abcd",
    "expireAt": "2026-02-20T14:52:15.123Z",
    "returnUrl": "https://你的网站/return"
  }
}

package main

import (
    "bytes"
    "crypto/md5"
    "encoding/hex"
    "sort"
    "strings"
)

// Sign188PayOrder builds the signature for POST /pay/address.
// subject does not participate in order signing.
func Sign188PayOrder(req map[string]string, secretKey string) string {
    signData := map[string]string{
        "merchantId":      req["merchantId"],
        "merchantOrderId": req["merchantOrderId"],
        "amount":          req["amount"],
        "notifyUrl":       req["notifyUrl"],
    }

    if req["coinType"] != "" {
        signData["coinType"] = req["coinType"]
    } else if req["paymentMethod"] == "" {
        signData["coinType"] = "usdt"
    }
    if req["returnUrl"] != "" {
        signData["returnUrl"] = req["returnUrl"]
    }
    if req["paymentMethod"] != "" {
        signData["paymentMethod"] = req["paymentMethod"]
    }

    return sign188PayStandard(signData, secretKey)
}

func sign188PayStandard(data map[string]string, secretKey string) string {
    keys := make([]string, 0, len(data))
    for k, v := range data {
        if k == "sign" || k == "sign_type" {
            continue
        }
        if v != "" {
            keys = append(keys, k)
        }
    }
    sort.Strings(keys)

    var buffer bytes.Buffer
    for i, k := range keys {
        if i > 0 {
            buffer.WriteString("&")
        }
        buffer.WriteString(k)
        buffer.WriteString("=")
        buffer.WriteString(data[k])
    }
    buffer.WriteString("&key=")
    buffer.WriteString(strings.TrimSpace(secretKey))

    hash := md5.Sum(buffer.Bytes())
    return strings.ToLower(hex.EncodeToString(hash[:]))
}

$content = file_get_contents('php://input');
$data = json_decode($content, true);
$receivedSign = $data['sign'];
unset($data['sign'], $data['sign_type']);
$data = array_filter($data, function($v) { return $v !== ''; });
ksort($data);
$str = '';
foreach ($data as $k => $v) {
    $value = $v === null ? 'null' : (string) $v;
    $str .= $k . '=' . $value . '&';
}
$str = rtrim($str, '&');
$str .= '&key=YOUR_SECRET_KEY';
$sign = md5($str);
if ($receivedSign === $sign) {
    echo 'success';
} else {
    echo 'fail';
}

const crypto = require('crypto');

function verifyCallback(body, secretKey) {
  const { sign, sign_type, ...params } = body;
  const sortedStr = Object.keys(params)
    .sort()
    .filter(k => params[k] !== '')
    .map(k => `${k}=${params[k]}`)
    .join('&');
  const computedSign = crypto
    .createHash('md5')
    .update(sortedStr + '&key=' + secretKey)
    .digest('hex');
  return computedSign === sign;
}

app.post('/callback', (req, res) => {
  if (verifyCallback(req.body, 'YOUR_SECRET_KEY')) {
    res.send('success');
  } else {
    res.send('fail');
  }
});

import hashlib

def verify_callback(body: dict, secret_key: str) -> bool:
    received_sign = body.pop('sign', '')
    body.pop('sign_type', None)
    filtered = {k: v for k, v in body.items() if v != ''}
    stringify = lambda v: 'null' if v is None else str(v)
    sorted_str = '&'.join(f'{k}={stringify(filtered[k])}' for k in sorted(filtered))
    sign_str = sorted_str + '&key=' + secret_key
    computed_sign = hashlib.md5(sign_str.encode()).hexdigest()
    return computed_sign == received_sign

@app.route('/callback', methods=['POST'])
def callback():
    data = request.get_json()
    if verify_callback(data.copy(), 'YOUR_SECRET_KEY'):
        return 'success'
    return 'fail'