Callback Verification

The platform only sends callbacks for SUCCESS trades. The signature is the same as merchant requests (HMAC-SHA256 + Base64).

Callback headers

Header	Required	Description
X-Merchant-Id	Yes	Merchant primary ID
X-Timestamp	Yes	Unix timestamp (milliseconds)
X-Nonce	Yes	32-char random string
X-Sign	Yes	HMAC-SHA256 signature (Base64)

HTTP header names are case-insensitive.

Signature algorithm

Signature string in fixed order (delimited by |):

timestamp|nonce|rawBody

Signature calculation:

signature = Base64(HMAC_SHA256(SignData, merchant_secret))

rawBody is the exact JSON string received in the callback. Do not reformat or reorder fields.

Callback example

{
  "payNo": "P202312230001",
  "tradeNo": "T202312230001",
  "merchantOrderNo": "ORDER_001",
  "amount": 10000,
  "currency": "USD",
  "tradeStatus": "SUCCESS",
  "finishTime": 1734921000000,
  "notifyTime": 1734921005000
}

Verification steps

1. Read X-Timestamp, X-Nonce, and X-Sign from headers.
2. Build the sign string with the raw request body and compute the signature.
3. Compare the computed value to X-Sign.

Handling notes

• Always verify before processing business logic.
• Callbacks may be delivered multiple times; handle idempotency.
• Return 200 OK quickly to avoid retries.