Go 示例

示例为：POST /payIn/orders/createAndPay，签名串为 timestamp|nonce|rawBody。

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
    "time"
)

func sign(timestamp, nonce, body, secret string) string {
    signData := timestamp + "|" + nonce + "|" + body
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(signData))
    return base64.StdEncoding.EncodeToString(mac.Sum(nil))
}

func main() {
    body := `{"merchantOrderNo":"M202412220001","amount":"100.00","currency":"USD",` +
        `"methodCode":"INTERNATIONAL_CARD","methodData":{"cardNumber":"4111111111111111",` +
        `"expiryMonth":"12","expiryYear":"27","securityCode":"123"}}`
    timestamp := fmt.Sprintf("%d", time.Now().UnixMilli())
    nonce := "b2b2f3b6a6f24a4ba3dcd0e777c9a888"
    signature := sign(timestamp, nonce, body, "sk_test_9f3b8a2d7c1e4f6a8b0c2d4e6f8a1b3c")

    // 发送 HTTP 请求并设置 Headers:
    // X-Merchant-Id, X-Timestamp, X-Nonce, X-Sign
    _ = signature
}

验签示例（回调）

rawBody 为实际接收的原始 JSON 字符串。

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
)

func sign(timestamp, nonce, body, secret string) string {
    signData := timestamp + "|" + nonce + "|" + body
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(signData))
    return base64.StdEncoding.EncodeToString(mac.Sum(nil))
}

func verify(timestamp, nonce, rawBody, secret, signHeader string) bool {
    expected := sign(timestamp, nonce, rawBody, secret)
    return hmac.Equal([]byte(expected), []byte(signHeader))
}

func main() {
    rawBody := `{"payNo":"P202312230001","tradeStatus":"SUCCESS"}`
    timestamp := "1734921005000"
    nonce := "b2b2f3b6a6f24a4ba3dcd0e777c9a888"
    signHeader := "base64_signature_from_header"

    ok := verify(timestamp, nonce, rawBody, "sk_test_9f3b8a2d7c1e4f6a8b0c2d4e6f8a1b3c", signHeader)
    fmt.Println(ok)
}