# Python
import hmac, hashlib, time, secrets, urllib.parse

params = {
    'app_id': app_id,
    'amount': 1000,
    'merchant_order_no': 'ORD20260315001',
    'notify_url': 'https://example.com/notify',
    'timestamp': int(time.time()),
    'nonce': secrets.token_hex(16),
}

# 去空值 + 排序 + 拼接
filtered = {k: v for k, v in params.items() if v not in ('', None)}
sign_str = '&'.join(f'{k}={v}' for k, v in sorted(filtered.items()))

# HMAC-SHA256
params['sign'] = hmac.new(
    app_secret.encode(), sign_str.encode(), hashlib.sha256
).hexdigest()

// Java
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.*;
import org.apache.commons.codec.binary.Hex;

Map<String, String> params = new TreeMap<>();  // TreeMap 自动排序
params.put("app_id", appId);
params.put("amount", "1000");
params.put("merchant_order_no", "ORD20260315001");
params.put("notify_url", "https://example.com/notify");
params.put("timestamp", String.valueOf(System.currentTimeMillis() / 1000));
params.put("nonce", UUID.randomUUID().toString().replace("-", ""));

// 拼接
StringBuilder sb = new StringBuilder();
params.forEach((k, v) -> {
    if (v != null && !v.isEmpty()) {
        if (sb.length() > 0) sb.append("&");
        sb.append(k).append("=").append(v);
    }
});

// HMAC-SHA256
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(appSecret.getBytes(), "HmacSHA256"));
String sign = Hex.encodeHexString(mac.doFinal(sb.toString().getBytes()));

// Node.js
const crypto = require('crypto');

const params = {
  app_id: appId,
  amount: 1000,
  merchant_order_no: 'ORD20260315001',
  notify_url: 'https://example.com/notify',
  timestamp: Math.floor(Date.now() / 1000),
  nonce: crypto.randomBytes(16).toString('hex'),
};

// 去空值 + 排序 + 拼接
const signStr = Object.keys(params)
  .filter(k => params[k] !== '' && params[k] != null)
  .sort()
  .map(k => `${k}=${params[k]}`)
  .join('&');

// HMAC-SHA256
params.sign = crypto.createHmac('sha256', appSecret)
  .update(signStr).digest('hex');

// Go
import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "sort"
    "strings"
)

params := map[string]string{
    "app_id":            appId,
    "amount":            "1000",
    "merchant_order_no": "ORD20260315001",
    "notify_url":        "https://example.com/notify",
    "timestamp":         fmt.Sprintf("%d", time.Now().Unix()),
    "nonce":             hex.EncodeToString(randomBytes(16)),
}

// 排序 + 拼接
keys := make([]string, 0, len(params))
for k, v := range params {
    if v != "" { keys = append(keys, k) }
}
sort.Strings(keys)
pairs := make([]string, len(keys))
for i, k := range keys { pairs[i] = k + "=" + params[k] }
signStr := strings.Join(pairs, "&")

// HMAC-SHA256
h := hmac.New(sha256.New, []byte(appSecret))
h.Write([]byte(signStr))
sign := hex.EncodeToString(h.Sum(nil))

// 微信小程序
wx.requestPayment({
  ...response.data.jsapi_pay_info,
  success(res) { console.log('支付成功', res); },
  fail(res)    { console.log('支付失败', res); }
});

// Java — 签名 + 下单 (需引入 okhttp、commons-codec)
TreeMap<String, String> params = new TreeMap<>();
params.put("app_id", appId);
params.put("merchant_order_no", "ORD" + System.currentTimeMillis());
params.put("amount", "1000");
params.put("notify_url", "https://your-domain.com/pay/callback");
params.put("extra", "{\"user_id\":12345}");
params.put("timestamp", String.valueOf(System.currentTimeMillis() / 1000));
params.put("nonce", UUID.randomUUID().toString().replace("-", ""));

// 签名
StringBuilder sb = new StringBuilder();
params.forEach((k, v) -> {
    if (v != null && !v.isEmpty()) {
        if (sb.length() > 0) sb.append("&");
        sb.append(k).append("=").append(v);
    }
});
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(appSecret.getBytes(), "HmacSHA256"));
String sign = Hex.encodeHexString(mac.doFinal(sb.toString().getBytes()));
params.put("sign", sign);

// 下单
RequestBody body = RequestBody.create(
    new Gson().toJson(params), MediaType.parse("application/json"));
Request request = new Request.Builder()
    .url(baseUrl + "/api/cashier/qrcode-pay")
    .post(body).build();
Response response = new OkHttpClient().newCall(request).execute();
// 解析 response.body().string()

# Python — 签名 + 下单
import hmac, hashlib, time, secrets, requests, json

params = {
    'app_id': app_id,
    'merchant_order_no': f'ORD{int(time.time())}',
    'amount': 1000,
    'notify_url': 'https://your-domain.com/pay/callback',
    'extra': json.dumps({'user_id': 12345}),
    'timestamp': int(time.time()),
    'nonce': secrets.token_hex(16),
}

# 签名
filtered = {k: v for k, v in params.items() if v not in ('', None)}
sign_str = '&'.join(f'{k}={v}' for k, v in sorted(filtered.items()))
params['sign'] = hmac.new(
    app_secret.encode(), sign_str.encode(), hashlib.sha256
).hexdigest()

# 下单
resp = requests.post(
    f'{base_url}/api/cashier/qrcode-pay', json=params
).json()
# resp['data']['qr_code_url'] → 二维码图片

// Node.js — 签名 + 下单
const crypto = require('crypto');
const axios = require('axios');

const params = {
  app_id: appId,
  merchant_order_no: `ORD${Date.now()}`,
  amount: 1000,
  notify_url: 'https://your-domain.com/pay/callback',
  extra: JSON.stringify({ user_id: 12345 }),
  timestamp: Math.floor(Date.now() / 1000),
  nonce: crypto.randomBytes(16).toString('hex'),
};

// 签名
const signStr = Object.keys(params)
  .filter(k => params[k] !== '' && params[k] != null)
  .sort()
  .map(k => `${k}=${params[k]}`)
  .join('&');
params.sign = crypto.createHmac('sha256', appSecret)
  .update(signStr).digest('hex');

// 下单
const { data } = await axios.post(
  `${baseUrl}/api/cashier/qrcode-pay`, params
);
// data.data.qr_code_url → 二维码图片

// Go — 签名 + 下单
package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "net/http"
    "sort"
    "strings"
    "time"
)

params := map[string]string{
    "app_id":            appId,
    "merchant_order_no": fmt.Sprintf("ORD%d", time.Now().Unix()),
    "amount":            "1000",
    "notify_url":        "https://your-domain.com/pay/callback",
    "extra":             `{"user_id":12345}`,
    "timestamp":         fmt.Sprintf("%d", time.Now().Unix()),
    "nonce":             hex.EncodeToString(randomBytes(16)),
}

// 签名
keys := make([]string, 0)
for k, v := range params {
    if v != "" { keys = append(keys, k) }
}
sort.Strings(keys)
pairs := make([]string, len(keys))
for i, k := range keys { pairs[i] = k + "=" + params[k] }
signStr := strings.Join(pairs, "&")

h := hmac.New(sha256.New, []byte(appSecret))
h.Write([]byte(signStr))
params["sign"] = hex.EncodeToString(h.Sum(nil))

// 下单
jsonData, _ := json.Marshal(params)
resp, _ := http.Post(
    baseUrl+"/api/cashier/qrcode-pay",
    "application/json",
    bytes.NewBuffer(jsonData),
)
// 解析 resp.Body → data.qr_code_url

<?php
/**
 * 聚合扫码支付 API 完整调用示例
 *
 * 包含签名计算、下单请求、响应处理的完整流程
 */

$appId     = 'your_app_id';     // 公钥
$appSecret = 'your_app_secret'; // 秘钥
$baseUrl   = 'https://payment.qiquan18.cn/api/cashier'; // 生产环境地址

// ─── 正确签名下单 ───
$orderNo = 'ORD_' . date('YmdHis') . '_' . mt_rand(1000, 9999);
$params = buildParams($appId, 1000, $orderNo); // 1000分 = 10元
$params['sign'] = makeSign($params, $appSecret);

echo "商户订单号: {$orderNo}\n";
$res = httpPost($baseUrl . '/qrcode-pay', $params);
echo "响应: " . json_encode($res['json'], JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) . "\n";

if ($res['json']['code'] === 200) {
    $qrCodeUrl = $res['json']['data']['qr_code_url'];
    echo "二维码: {$qrCodeUrl}\n";
}

// ────── 工具函数 ──────

function buildParams(string $appId, int $amount, string $merchantOrderNo): array
{
    return [
        'app_id'            =&gt; $appId,
        'merchant_order_no' =&gt; $merchantOrderNo,
        'amount'            =&gt; $amount,
        'notify_url'        =&gt; 'https://your-domain.com/pay/callback',
        'extra'             =&gt; json_encode(['user_id' =&gt; 12345]),
        'note'              =&gt; '在线支付',
        'timestamp'         =&gt; time(),
        'nonce'             =&gt; bin2hex(random_bytes(16)),
    ];
}

function makeSign(array $params, string $secret): string
{
    unset($params['sign']);
    $params = array_filter($params, fn($v) =&gt; $v !== '' &amp;&amp; $v !== null);
    ksort($params);

    $pairs = [];
    foreach ($params as $k =&gt; $v) {
        $pairs[] = "{$k}={$v}";
    }
    $signStr = implode('&amp;', $pairs);

    return hash_hmac('sha256', $signStr, $secret);
}

function httpPost(string $url, array $data): array
{
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_POST           =&gt; true,
        CURLOPT_HTTPHEADER     =&gt; ['Content-Type: application/json', 'Accept: application/json'],
        CURLOPT_POSTFIELDS     =&gt; json_encode($data),
        CURLOPT_RETURNTRANSFER =&gt; true,
        CURLOPT_TIMEOUT        =&gt; 30,
    ]);
    $body = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $error = curl_error($ch);
    curl_close($ch);

    return [
        'http_code' =&gt; $httpCode,
        'body'      =&gt; $body,
        'error'     =&gt; $error,
        'json'      =&gt; json_decode($body, true),
    ];
}