#webdemo — WeChat Pay & Alipay integration-check web app

1. / — WeChat · Native (QR) — creates a Native order (POST /api/orders) through Client::native_order, renders the returned code_url as a QR code, polls the order (GET /api/orders/<out_trade_no>) through Client::query_order every two seconds, and accepts WeChat Pay's signed callback (POST /api/wechat/notify) through Client::verify_callback, reconciling the amount and acknowledging it. The page also has a JSAPI section: POST /api/wechat/jsapi/orders?amount_yuan=…&openid=… places an in-WeChat order through Client::jsapi_order and returns the signed wx.requestPayment parameter set (Client::jsapi_pay_params) — paste it into the WeChat devtools or drive it from a mini-program backend; the order polls through the same endpoint. With the mini-program credentials WXPAY_MINIAPP_APPID / WXPAY_MINIAPP_APP_SECRET set (falling back to WXPAY_APPID / WXPAY_APP_SECRET), the page also gains a mini-program section: POST /api/wechat/miniapp/orders?amount_yuan=…&js_code=… exchanges the wx.login code for the payer's openid and places the order in one call (miniprogram.Client::pay), returning the same signed parameter set; the panel's merchant identity can be overridden separately through the WXPAY_MINIAPP_MCHID etc. variables (see the table below).
2. /alipay — Alipay · page pay — builds the signed cashier URL (POST /api/alipay/orders, alipay.trade.page.pay) through Client::page_pay_url and redirects the browser to it; when Alipay sends the customer back to /alipay?alipay_order=<out_trade_no> the page resumes polling through GET /api/alipay/orders/<out_trade_no>; and accepts Alipay's async notification (POST /api/alipay/notify) through Client::verify_notify, answering the plain-text success that stops Alipay's retries.

#Configuration

cp cmd/webdemo/env.example.sh cmd/webdemo/env.sh
$EDITOR cmd/webdemo/env.sh          # fill in real gateway credentials
source cmd/webdemo/env.sh && moon run cmd/webdemo

#WeChat Pay (WXPAY_*)

#Alipay (ALIPAY_*)

#What each value must be

• A mini-program appid also works for Native QR payment (no openid involved) as long as it is bound to the merchant id (商户平台 → 产品中心 → AppID账号管理). Starting payment inside a mini-program is JSAPI ordering, which the SDK does not implement yet.
• SIGN_ERROR is a signature-layer rejection that happens before the appid / product permission checks: the private key, the serial in the request, or the clock is wrong — it is not a permissions problem.
• An Alipay 40002 invalid-signature on the first real request means the gateway found the app but the application public key registered in the console does not pair with ALIPAY_PRIVATE_KEY. Re-upload the application public key derived from that private key (openssl pkey -in <private_key.pem> -pubout), and check the console's 接口加签方式 is 公钥模式 — 公钥证书 (certificate mode) also answers invalid-signature and is not supported by this SDK.
• A cashier page answering 订单信息无法识别 / INVALID_PARAMETER (or redirecting to errorCode=FISHING_RISK) means the signature was accepted but the trade cannot be created for this app: the app must be released (已上线, not 开发中) and 电脑网站支付 must be signed (商家平台 → 产品中心 → 我的产品; requires business qualification). For flow testing without a signed product, use the sandbox: sandbox credentials plus ALIPAY_GATEWAY_URL=https://openapi-sandbox.dl.alipaydev.com/gateway.do.

#Alipay return URL

#Running

WXPAY_APPID=wx… WXPAY_MCHID=1900… WXPAY_SERIAL_NO=… \
WXPAY_PRIVATE_KEY=./apiclient_key.pem WXPAY_API_V3_KEY=… \
moon run cmd/webdemo

#Real charges