接口文档

function makeSign(array $params, string $merchantKey): string
{
    unset($params['sign'], $params['sign_type']);
    $params = array_filter($params, static fn($value) => $value !== '');
    ksort($params);

    $pairs = [];
    foreach ($params as $key => $value) {
        $pairs[] = $key . '=' . $value;
    }
    return md5(implode('&', $pairs) . $merchantKey);
}

static String makeSign(Map<String, String> input, String merchantKey) throws Exception {
    TreeMap<String, String> sorted = new TreeMap<>(input);
    sorted.remove("sign");
    sorted.remove("sign_type");
    String source = sorted.entrySet().stream()
        .filter(item -> item.getValue() != null && !item.getValue().isEmpty())
        .map(item -> item.getKey() + "=" + item.getValue())
        .collect(Collectors.joining("&")) + merchantKey;
    byte[] digest = MessageDigest.getInstance("MD5")
        .digest(source.getBytes(StandardCharsets.UTF_8));
    StringBuilder result = new StringBuilder();
    for (byte value : digest) result.append(String.format("%02x", value & 0xff));
    return result.toString();
}

static string MakeSign(IDictionary<string, string> input, string merchantKey)
{
    var source = string.Join("&", input
        .Where(item => item.Key != "sign" && item.Key != "sign_type" && item.Value != "")
        .OrderBy(item => item.Key, StringComparer.Ordinal)
        .Select(item => item.Key + "=" + item.Value)) + merchantKey;
    return Convert.ToHexString(
        MD5.HashData(Encoding.UTF8.GetBytes(source))
    ).ToLowerInvariant();
}

import hashlib

def make_sign(params: dict, merchant_key: str) -> str:
    pairs = [
        f"{name}={value}"
        for name, value in sorted(params.items())
        if name not in ("sign", "sign_type") and value != ""
    ]
    source = "&".join(pairs) + merchant_key
    return hashlib.md5(source.encode("utf-8")).hexdigest()

$params = [
    'pid' => 'YOUR_MERCHANT_ID',
    'out_trade_no' => 'PAYOUT_' . date('YmdHis'),
    'alipay_account' => 'user@example.com',
    'payee_name' => '张三',
    'money' => '100.00',
    'notify_url' => 'https://merchant.example/payout-notify',
];
$params['sign'] = makeSign($params, 'YOUR_MERCHANT_KEY');
$params['sign_type'] = 'MD5';
$ch = curl_init('https://k.jctapay.com/PayoutApi/create');
curl_setopt_array($ch, [CURLOPT_POST => true, CURLOPT_POSTFIELDS => $params, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 15]);
$response = curl_exec($ch);

Map<String, String> params = new HashMap<>();
params.put("pid", "YOUR_MERCHANT_ID");
params.put("out_trade_no", "PAYOUT_20260729_000001");
params.put("alipay_account", "user@example.com");
params.put("payee_name", "张三");
params.put("money", "100.00");
params.put("notify_url", "https://merchant.example/payout-notify");
params.put("sign", makeSign(params, "YOUR_MERCHANT_KEY"));
params.put("sign_type", "MD5");
HttpRequest request = HttpRequest.newBuilder(URI.create("https://k.jctapay.com/PayoutApi/create"))
    .header("Content-Type", "application/x-www-form-urlencoded")
    .POST(HttpRequest.BodyPublishers.ofString(formEncode(params))).build();
String response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString()).body();

var fields = new Dictionary<string, string> {
    ["pid"] = "YOUR_MERCHANT_ID", ["out_trade_no"] = "PAYOUT_20260729_000001",
    ["alipay_account"] = "user@example.com", ["payee_name"] = "张三",
    ["money"] = "100.00", ["notify_url"] = "https://merchant.example/payout-notify"
};
fields["sign"] = MakeSign(fields, "YOUR_MERCHANT_KEY");
fields["sign_type"] = "MD5";
using var client = new HttpClient();
var response = await client.PostAsync("https://k.jctapay.com/PayoutApi/create", new FormUrlEncodedContent(fields));
var body = await response.Content.ReadAsStringAsync();

import requests

params = {
    "pid": "YOUR_MERCHANT_ID", "out_trade_no": "PAYOUT_20260729_000001",
    "alipay_account": "user@example.com", "payee_name": "张三",
    "money": "100.00", "notify_url": "https://merchant.example/payout-notify",
}
params["sign"] = make_sign(params, "YOUR_MERCHANT_KEY")
params["sign_type"] = "MD5"
response = requests.post("https://k.jctapay.com/PayoutApi/create", data=params, timeout=15)
print(response.json())

<?php
$baseUrl = 'https://k.jctapay.com';
$merchantPid = 'YOUR_MERCHANT_ID';
$merchantKey = 'YOUR_MERCHANT_KEY';
$uploadPid = 'YOUR_UPLOAD_ACCOUNT_ID';
$uploadKey = 'YOUR_UPLOAD_ACCOUNT_KEY';

function makeSign(array $params, string $key): string {
    unset($params['sign'], $params['sign_type']);
    $params = array_filter($params, static fn($value) => $value !== '');
    ksort($params);
    $pairs = [];
    foreach ($params as $name => $value) $pairs[] = $name . '=' . $value;
    return md5(implode('&', $pairs) . $key);
}

function postForm(string $url, array $params, string $key): string {
    $params['sign'] = makeSign($params, $key);
    $params['sign_type'] = 'MD5';
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query($params),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 15,
        CURLOPT_SSL_VERIFYPEER => true,
        CURLOPT_SSL_VERIFYHOST => 2,
    ]);
    $body = curl_exec($ch);
    if ($body === false) throw new RuntimeException(curl_error($ch));
    curl_close($ch);
    return $body;
}

// 1. 统一下单：服务端接入使用统一下单地址。
$payJson = postForm($baseUrl . '/mapi.php', [
    'pid' => $merchantPid, 'type' => 'YOUR_PAY_CODE',
    'out_trade_no' => 'ORDER_' . date('YmdHis'),
    'notify_url' => 'https://merchant.example/callback',
    'return_url' => 'https://merchant.example/result',
    'name' => '业务订单', 'money' => '100.00',
], $merchantKey);

// 2. 商户订单查询。
$queryJson = postForm($baseUrl . '/Api/findorder', [
    'pid' => $merchantPid, 'order_no' => 'ORDER_20260721_000001', 'type' => '2',
], $merchantKey);
$query = json_decode($queryJson, true, 512, JSON_THROW_ON_ERROR);

// 3. 订单上传：使用本地已保存的唯一业务单号，重试时保持不变。
$uploadOutTradeNo = 'UPLOAD_20260721_000001';
$uploadJson = postForm($baseUrl . '/OrderApi/upload', [
    'pid' => $uploadPid,
    'order_code' => 'dy',
    'out_trade_no' => $uploadOutTradeNo,
    'target_account' => 'ACCOUNT_000001', 'money' => '100',
    'notify_url' => 'https://uploader.example/callback',
], $uploadKey);

// 4. 上传订单查询。
$uploadQueryJson = postForm($baseUrl . '/OrderApi/query', [
    'pid' => $uploadPid,
    'order_code' => 'dy',
    'out_trade_no' => $uploadOutTradeNo,
], $uploadKey);

// 5. 查询结果：先检查接口结果，再读取 data.status 并核对外部订单号。
$result = json_decode($uploadQueryJson, true, 512, JSON_THROW_ON_ERROR);
if (($result['code'] ?? null) !== 200) {
    throw new RuntimeException('查单接口未成功，不更新订单终态');
}
$data = $result['data'] ?? [];
if (($data['out_trade_no'] ?? '') !== $uploadOutTradeNo) {
    throw new RuntimeException('查询返回的订单号不一致');
}
if (!isset($data['status']) || !is_int($data['status']) || !in_array($data['status'], [0,1,2,3], true)) {
    throw new RuntimeException('未知订单状态，需核对');
}
switch ($data['status'] ?? null) {
    case 0: case 1: /* 仍在等待/处理中，保持未完成 */ break;
    case 2: /* 幂等保存这笔上传订单的成功结果 */ break;
    case 3: /* 幂等保存失败结果及 failure_reason，不记为成功 */ break;
    default: throw new RuntimeException('未知订单状态，需核对');
}

// 6. 上传回调处理函数：放到独立回调路由中，不要在该路由执行上面的下单示例。
// localOrder：按上传账户 + out_trade_no 读取的本地订单，money 保存为两位小数字符串。
// commitResult：由接入方实现事务与幂等，保存明确的 succeeded/failed 结果后才返回 true。
// 重复且一致的通知可返回 true；数据库失败、终态冲突必须抛异常或返回 false。
// 路由成功调用本函数后，才将返回值作为 HTTP 200 的纯文本正文；异常时不确认通知。
function handleUploadCallback(array $query, array $localOrder, string $uploadPid,
    string $uploadKey, callable $commitResult): string {
    foreach ($query as $value) {
        if (!is_string($value)) throw new RuntimeException('回调参数须为 GET 字符串');
    }
    foreach (['pid','order_code','trade_no','out_trade_no','target_account','money','status','sign'] as $field) {
        if (!isset($query[$field]) || $query[$field] === '') throw new RuntimeException('回调缺少参数');
    }
    if (!hash_equals(makeSign($query, $uploadKey), $query['sign'])) {
        throw new RuntimeException('上传回调验签失败');
    }
    if ($query['pid'] !== $uploadPid || $query['order_code'] !== 'dy'
        || (string)($localOrder['pid'] ?? '') !== $uploadPid
        || $query['out_trade_no'] !== ($localOrder['out_trade_no'] ?? '')
        || $query['target_account'] !== ($localOrder['target_account'] ?? '')
        || $query['money'] !== ($localOrder['money'] ?? '')
        || (!empty($localOrder['trade_no']) && $query['trade_no'] !== $localOrder['trade_no'])) {
        throw new RuntimeException('回调与本地订单不匹配');
    }
    if ($query['status'] === '2') {
        $outcome = 'succeeded';
        $reason = '';
    } elseif ($query['status'] === '3') {
        $outcome = 'failed';
        $reason = $query['failure_reason'] ?? '';
    } else {
        throw new RuntimeException('未知回调状态');
    }
    if ($commitResult($localOrder, $outcome, $reason, $query) !== true) {
        throw new RuntimeException('业务结果尚未保存');
    }
    return 'success'; // 仅为通知接收确认，订单结果由 outcome 决定。
}

import java.net.URI;
import java.net.URLEncoder;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Map;
import java.util.TreeMap;
import java.util.stream.Collectors;

public final class YPayDemo {
    static final String BASE_URL = "https://k.jctapay.com";
    static final String MERCHANT_PID = "YOUR_MERCHANT_ID";
    static final String MERCHANT_KEY = "YOUR_MERCHANT_KEY";
    static final String UPLOAD_PID = "YOUR_UPLOAD_ACCOUNT_ID";
    static final String UPLOAD_KEY = "YOUR_UPLOAD_ACCOUNT_KEY";
    static final HttpClient HTTP = HttpClient.newHttpClient();

    static String sign(Map<String, String> input, String key) throws Exception {
        TreeMap<String, String> sorted = new TreeMap<>(input);
        sorted.remove("sign"); sorted.remove("sign_type");
        String source = sorted.entrySet().stream()
            .filter(e -> e.getValue() != null && !e.getValue().isEmpty())
            .map(e -> e.getKey() + "=" + e.getValue())
            .collect(Collectors.joining("&")) + key;
        byte[] digest = MessageDigest.getInstance("MD5")
            .digest(source.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : digest) hex.append(String.format("%02x", b & 0xff));
        return hex.toString();
    }

    static String post(String path, Map<String, String> input, String key) throws Exception {
        Map<String, String> params = new TreeMap<>(input);
        params.put("sign", sign(params, key));
        params.put("sign_type", "MD5");
        String form = params.entrySet().stream()
            .map(e -> URLEncoder.encode(e.getKey(), StandardCharsets.UTF_8) + "="
                + URLEncoder.encode(e.getValue(), StandardCharsets.UTF_8))
            .collect(Collectors.joining("&"));
        HttpRequest request = HttpRequest.newBuilder(URI.create(BASE_URL + path))
            .header("Content-Type", "application/x-www-form-urlencoded")
            .POST(HttpRequest.BodyPublishers.ofString(form)).build();
        return HTTP.send(request, HttpResponse.BodyHandlers.ofString()).body();
    }

    public static void main(String[] args) throws Exception {
        // 商户下单，返回 JSON。
        String payJson = post("/mapi.php", Map.of(
            "pid", MERCHANT_PID, "type", "YOUR_PAY_CODE",
            "out_trade_no", "ORDER_20260721_000001",
            "notify_url", "https://merchant.example/callback",
            "return_url", "https://merchant.example/result",
            "name", "业务订单", "money", "100.00"), MERCHANT_KEY);

        String orderJson = post("/Api/findorder", Map.of(
            "pid", MERCHANT_PID, "order_no", "ORDER_20260721_000001", "type", "2"),
            MERCHANT_KEY);

        String uploadJson = post("/OrderApi/upload", Map.of(
            "pid", UPLOAD_PID,
            "order_code", "dy",
            "out_trade_no", "UPLOAD_20260721_000001", "target_account", "ACCOUNT_000001",
            "money", "100", "notify_url", "https://uploader.example/callback"),
            UPLOAD_KEY);

        String uploadOrderJson = post("/OrderApi/query", Map.of(
            "pid", UPLOAD_PID,
            "order_code", "dy",
            "out_trade_no", "UPLOAD_20260721_000001"), UPLOAD_KEY);
    }

    static boolean verifyCallback(Map<String, String> query, String key) throws Exception {
        String received = query.get("sign");
        return received != null && MessageDigest.isEqual(
            sign(query, key).getBytes(StandardCharsets.US_ASCII),
            received.getBytes(StandardCharsets.US_ASCII));
    }
}

using System.Security.Cryptography;
using System.Text;

public static class YPayDemo
{
    const string BaseUrl = "https://k.jctapay.com";
    const string MerchantPid = "YOUR_MERCHANT_ID";
    const string MerchantKey = "YOUR_MERCHANT_KEY";
    const string UploadPid = "YOUR_UPLOAD_ACCOUNT_ID";
    const string UploadKey = "YOUR_UPLOAD_ACCOUNT_KEY";
    static readonly HttpClient Http = new();

    static string MakeSign(IDictionary<string, string> input, string key)
    {
        var source = string.Join("&", input
            .Where(p => p.Key != "sign" && p.Key != "sign_type" && p.Value != "")
            .OrderBy(p => p.Key, StringComparer.Ordinal)
            .Select(p => p.Key + "=" + p.Value)) + key;
        return Convert.ToHexString(MD5.HashData(Encoding.UTF8.GetBytes(source))).ToLowerInvariant();
    }

    static async Task<string> PostAsync(
        string path, IDictionary<string, string> input, string key)
    {
        var data = new Dictionary<string, string>(input) {
            ["sign"] = MakeSign(input, key), ["sign_type"] = "MD5"
        };
        using var response = await Http.PostAsync(BaseUrl + path, new FormUrlEncodedContent(data));
        response.EnsureSuccessStatusCode();
        return await response.Content.ReadAsStringAsync();
    }

    public static async Task RunAsync()
    {
        // 商户下单，返回 JSON。
        var payJson = await PostAsync("/mapi.php", new Dictionary<string, string> {
            ["pid"] = MerchantPid, ["type"] = "YOUR_PAY_CODE",
            ["out_trade_no"] = "ORDER_20260721_000001",
            ["notify_url"] = "https://merchant.example/callback",
            ["return_url"] = "https://merchant.example/result",
            ["name"] = "业务订单", ["money"] = "100.00"
        }, MerchantKey);

        var orderJson = await PostAsync("/Api/findorder", new Dictionary<string, string> {
            ["pid"] = MerchantPid, ["order_no"] = "ORDER_20260721_000001", ["type"] = "2"
        }, MerchantKey);

        var uploadJson = await PostAsync("/OrderApi/upload", new Dictionary<string, string> {
            ["pid"] = UploadPid,
            ["order_code"] = "dy",
            ["out_trade_no"] = "UPLOAD_20260721_000001", ["target_account"] = "ACCOUNT_000001",
            ["money"] = "100", ["notify_url"] = "https://uploader.example/callback"
        }, UploadKey);

        var uploadOrderJson = await PostAsync("/OrderApi/query", new Dictionary<string, string> {
            ["pid"] = UploadPid,
            ["order_code"] = "dy",
            ["out_trade_no"] = "UPLOAD_20260721_000001"
        }, UploadKey);
    }

    // ASP.NET 回调处理中将 Request.Query 转为字典后验签。
    static bool VerifyCallback(IDictionary<string, string> query, string key)
    {
        return query.TryGetValue("sign", out var received)
            && CryptographicOperations.FixedTimeEquals(
                Encoding.ASCII.GetBytes(MakeSign(query, key)),
                Encoding.ASCII.GetBytes(received));
    }
}

import hashlib
import hmac
import requests

BASE_URL = "https://k.jctapay.com"
MERCHANT_PID = "YOUR_MERCHANT_ID"
MERCHANT_KEY = "YOUR_MERCHANT_KEY"
UPLOAD_PID = "YOUR_UPLOAD_ACCOUNT_ID"
UPLOAD_KEY = "YOUR_UPLOAD_ACCOUNT_KEY"

def make_sign(params: dict, key: str) -> str:
    pairs = [
        f"{name}={value}"
        for name, value in sorted(params.items())
        if name not in ("sign", "sign_type") and value != ""
    ]
    return hashlib.md5(("&".join(pairs) + key).encode("utf-8")).hexdigest()

def post(path: str, params: dict, key: str) -> str:
    payload = dict(params)
    payload["sign"] = make_sign(payload, key)
    payload["sign_type"] = "MD5"
    response = requests.post(BASE_URL + path, data=payload, timeout=15)
    response.raise_for_status()
    return response.text

# 1. 商户下单，返回 JSON。
pay_json = post("/mapi.php", {
    "pid": MERCHANT_PID, "type": "YOUR_PAY_CODE",
    "out_trade_no": "ORDER_20260721_000001",
    "notify_url": "https://merchant.example/callback",
    "return_url": "https://merchant.example/result",
    "name": "业务订单", "money": "100.00",
}, MERCHANT_KEY)

# 2. 商户订单查询。
order_json = post("/Api/findorder", {
    "pid": MERCHANT_PID, "order_no": "ORDER_20260721_000001", "type": "2",
}, MERCHANT_KEY)

# 3. 订单上传。
upload_json = post("/OrderApi/upload", {
    "pid": UPLOAD_PID,
    "order_code": "dy",
    "out_trade_no": "UPLOAD_20260721_000001", "target_account": "ACCOUNT_000001",
    "money": "100", "notify_url": "https://uploader.example/callback",
}, UPLOAD_KEY)

# 4. 上传订单查询。
upload_order_json = post("/OrderApi/query", {
    "pid": UPLOAD_PID,
    "order_code": "dy",
    "out_trade_no": "UPLOAD_20260721_000001",
}, UPLOAD_KEY)

# 5. Flask/Django/FastAPI 回调处理中传入查询参数验签。
def verify_callback(query: dict, key: str) -> bool:
    received = query.get("sign", "")
    return bool(received) and hmac.compare_digest(make_sign(query, key), received)

# 上传回调使用 UPLOAD_KEY；按账户和 out_trade_no 定位订单并核对目标、金额。
# status=2 保存成功；status=3 保存失败。事务落库并幂等处理后才 return "success"。
# 验签失败、未知状态、保存失败或终态冲突时不确认通知；不要只凭验签成功回复 success。