API Documentation

How merchants connect to this platform. There are two APIs:

• Payout API std1: apply for a payout, query a payout, query your balance; we call you back when a payout has a result. New merchants use this one. See Payout API std1.
• Collection API compat1 (legacy protocol): create an order, query it, query your balance; we call you back when the payer has paid. Merchants already integrated with the old system's collection API keep using it: only the address changes, not your code. See Collection API compat1.

Addresses of this platform #

• Send every request to the “API address” above; each API page gives the path. Both http and https work; https is recommended.
• Our callbacks come from the “callback source IPs” above. If you allow-list callback sources, add them.

Before you start #

1. Merchant ID: the operator gives it to you. New merchant IDs look like MCH58001; merchants moved from the old system keep their ID.
2. API key: one per merchant, shared by the payout API std1 and the collection API compat1, shown under “Merchant › Security” in the merchant portal. New merchants get a 64-character hex string; merchants moved from the old system keep their existing merchant private key. Keep the key on your servers only, never in a web page or a mobile app.
3. IP allow-list: give the operator the outbound IPs of the servers that call the API. While your payout list is empty, every payout request is rejected.
4. Callback URL: reachable from the internet; reply success once you have processed a callback.

Conventions #

• Amounts are integers in the currency's minor unit: for a two-decimal currency 10000 means 100.00.
• Times: std1 uses yyyy-MM-dd HH:mm:ss in Beijing time (UTC+8); in the legacy protocol reqTime is yyyyMMddHHmmss and paySuccTime is milliseconds.
• Character set: UTF-8.
• Signatures differ between the two APIs; see Signatures.
• When a result is uncertain, query first. Never resubmit under a new order number.

Where to start #