# Python
import hmac, hashlib, time, secrets, urllib.parse

params = {
    'app_id': app_id,
    'amount': 1000,
    'merchant_order_no': 'ORD20260315001',
    'notify_url': 'https://example.com/notify',
    'timestamp': int(time.time()),
    'nonce': secrets.token_hex(16),
}

# 去空值 + 排序 + 拼接
filtered = {k: v for k, v in params.items() if v not in ('', None)}
sign_str = '&'.join(f'{k}={v}' for k, v in sorted(filtered.items()))

# HMAC-SHA256
params['sign'] = hmac.new(
    app_secret.encode(), sign_str.encode(), hashlib.sha256
).hexdigest()

// Java
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.*;
import org.apache.commons.codec.binary.Hex;

Map<String, String> params = new TreeMap<>();  // TreeMap 自动排序
params.put("app_id", appId);
params.put("amount", "1000");
params.put("merchant_order_no", "ORD20260315001");
params.put("notify_url", "https://example.com/notify");
params.put("timestamp", String.valueOf(System.currentTimeMillis() / 1000));
params.put("nonce", UUID.randomUUID().toString().replace("-", ""));

// 拼接
StringBuilder sb = new StringBuilder();
params.forEach((k, v) -> {
    if (v != null && !v.isEmpty()) {
        if (sb.length() > 0) sb.append("&");
        sb.append(k).append("=").append(v);
    }
});

// HMAC-SHA256
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(appSecret.getBytes(), "HmacSHA256"));
String sign = Hex.encodeHexString(mac.doFinal(sb.toString().getBytes()));

// Node.js
const crypto = require('crypto');

const params = {
  app_id: appId,
  amount: 1000,
  merchant_order_no: 'ORD20260315001',
  notify_url: 'https://example.com/notify',
  timestamp: Math.floor(Date.now() / 1000),
  nonce: crypto.randomBytes(16).toString('hex'),
};

// 去空值 + 排序 + 拼接
const signStr = Object.keys(params)
  .filter(k => params[k] !== '' && params[k] != null)
  .sort()
  .map(k => `${k}=${params[k]}`)
  .join('&');

// HMAC-SHA256
params.sign = crypto.createHmac('sha256', appSecret)
  .update(signStr).digest('hex');

// Go
import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "sort"
    "strings"
)

params := map[string]string{
    "app_id":            appId,
    "amount":            "1000",
    "merchant_order_no": "ORD20260315001",
    "notify_url":        "https://example.com/notify",
    "timestamp":         fmt.Sprintf("%d", time.Now().Unix()),
    "nonce":             hex.EncodeToString(randomBytes(16)),
}

// 排序 + 拼接
keys := make([]string, 0, len(params))
for k, v := range params {
    if v != "" { keys = append(keys, k) }
}
sort.Strings(keys)
pairs := make([]string, len(keys))
for i, k := range keys { pairs[i] = k + "=" + params[k] }
signStr := strings.Join(pairs, "&")

// HMAC-SHA256
h := hmac.New(sha256.New, []byte(appSecret))
h.Write([]byte(signStr))
sign := hex.EncodeToString(h.Sum(nil))

// 微信小程序
wx.requestPayment({
  timeStamp: response.data.jsapi_pay_info.timeStamp,
  nonceStr: response.data.jsapi_pay_info.nonceStr,
  package: response.data.jsapi_pay_info.package,
  signType: response.data.jsapi_pay_info.signType,
  paySign: response.data.jsapi_pay_info.paySign,
  success(res) { console.log('支付成功', res); },
  fail(res)  { console.log('支付失败', res); }
});

// Java — 签名 + 下单 (需引入 okhttp、commons-codec)
                    TreeMap<String, String> params = new TreeMap<>();
                    params.put("app_id", appId);
                    params.put("merchant_order_no", "ORD" + System.currentTimeMillis());
                    params.put("amount", "1000");
                    params.put("notify_url", "https://your-domain.com/pay/callback");
                    params.put("extra", "{\"user_id\":12345}");
                    params.put("timestamp", String.valueOf(System.currentTimeMillis() / 1000));
                    params.put("nonce", UUID.randomUUID().toString().replace("-", ""));

                    // 签名
                    StringBuilder sb = new StringBuilder();
                    params.forEach((k, v) -> {
    if (v != null && !v.isEmpty()) {
        if (sb.length() > 0) sb.append("&");
                    sb.append(k).append("=").append(v);
    }
});
                    Mac mac = Mac.getInstance("HmacSHA256");
                    mac.init(new SecretKeySpec(appSecret.getBytes(), "HmacSHA256"));
                    String sign = Hex.encodeHexString(mac.doFinal(sb.toString().getBytes()));
                    params.put("sign", sign);

                    // 下单
                    RequestBody body = RequestBody.create(
                    new Gson().toJson(params), MediaType.parse("application/json"));
                    Request request = new Request.Builder()
                    .url(baseUrl + "/api/cashier/qrcode-pay")
                    .post(body).build();
                    Response response = new OkHttpClient().newCall(request).execute();
// 解析 response.body().string()

# Python — 签名 + 下单
                    import hmac, hashlib, time, secrets, requests, json

                    params = {
                      'app_id': app_id,
                    'merchant_order_no': f'ORD{int(time.time())}',
                    'amount': 1000,
                    'notify_url': 'https://your-domain.com/pay/callback',
                    'extra': json.dumps({'user_id': 12345}),
                    'timestamp': int(time.time()),
                    'nonce': secrets.token_hex(16),
}

                    # 签名
                    filtered = {k: v for k, v in params.items() if v not in ('', None)}
                    sign_str = '&'.join(f'{k}={v}' for k, v in sorted(filtered.items()))
                    params['sign'] = hmac.new(
                    app_secret.encode(), sign_str.encode(), hashlib.sha256
                    ).hexdigest()

                    # 下单
                    resp = requests.post(
                    f'{base_url}/api/cashier/qrcode-pay', json=params
                    ).json()
                    # resp['data']['qrCodeUrl'] → 二维码图片

// Node.js — 签名 + 下单
                    const crypto = require('crypto');
                    const axios = require('axios');

                    const params = {
                      app_id: appId,
                    merchant_order_no: `ORD${Date.now()}`,
                    amount: 1000,
                    notify_url: 'https://your-domain.com/pay/callback',
                    extra: JSON.stringify({user_id: 12345 }),
                    timestamp: Math.floor(Date.now() / 1000),
                    nonce: crypto.randomBytes(16).toString('hex'),
};

                    // 签名
                    const signStr = Object.keys(params)
                    .filter(k => params[k] !== '' && params[k] != null)
                    .sort()
                    .map(k => `${k}=${params[k]}`)
                    .join('&');
                    params.sign = crypto.createHmac('sha256', appSecret)
                    .update(signStr).digest('hex');

                    // 下单
                    const {data} = await axios.post(
                    `${baseUrl}/api/cashier/qrcode-pay`, params
                    );
// data.data.qrCodeUrl → 二维码图片

// Go — 签名 + 下单
                    package main

                    import (
                    "crypto/hmac"
                    "crypto/sha256"
                    "encoding/hex"
                    "encoding/json"
                    "fmt"
                    "net/http"
                    "sort"
                    "strings"
                    "time"
                    )

                    params := map[string]string{
                      "app_id":            appId,
                    "merchant_order_no": fmt.Sprintf("ORD%d", time.Now().Unix()),
                    "amount":            "1000",
                    "notify_url":        "https://your-domain.com/pay/callback",
                    "extra":             `{"user_id":12345}`,
                    "timestamp":         fmt.Sprintf("%d", time.Now().Unix()),
                    "nonce":             hex.EncodeToString(randomBytes(16)),
}

                    // 签名
                    keys := make([]string, 0)
                    for k, v := range params {
    if v != "" {keys = append(keys, k)}
}
                    sort.Strings(keys)
                    pairs := make([]string, len(keys))
                    for i, k := range keys {pairs[i] = k + "=" + params[k]}
                    signStr := strings.Join(pairs, "&")

                    h := hmac.New(sha256.New, []byte(appSecret))
                    h.Write([]byte(signStr))
                    params["sign"] = hex.EncodeToString(h.Sum(nil))

                    // 下单
                    jsonData, _ := json.Marshal(params)
                    resp, _ := http.Post(
                    baseUrl+"/api/cashier/qrcode-pay",
                    "application/json",
                    bytes.NewBuffer(jsonData),
                    )
// 解析 resp.Body → data.qrCodeUrl

<?php
                    /**
                     * 聚合扫码支付 API 完整调用示例
                     *
                     * 包含签名计算、下单请求、响应处理的完整流程
                     */

                    $appId     = 'your_app_id';     // 公钥
                    $appSecret = 'your_app_secret'; // 秘钥
                    $baseUrl   = 'https://pay.your-domain.com/api/cashier'; // 生产环境地址

                    // ─── 正确签名下单 ───
                    $orderNo = 'ORD_' . date('YmdHis') . '_' . mt_rand(1000, 9999);
                    $params = buildParams($appId, 1000, $orderNo); // 1000分 = 10元
                    $params['sign'] = makeSign($params, $appSecret);

                    echo "商户订单号: {$orderNo}\n";
                    $res = httpPost($baseUrl . '/qrcode-pay', $params);
                    echo "响应: " . json_encode($res['json'], JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) . "\n";

                    if ($res['json']['code'] === 200) {
                      $qrCodeUrl = $res['json']['data']['qrCodeUrl'];
                    echo "二维码: {$qrCodeUrl}\n";
}

                    // ────── 工具函数 ──────

                    function buildParams(string $appId, int $amount, string $merchantOrderNo): array
                    {
    return [
                    'app_id'            =&gt; $appId,
                    'merchant_order_no' =&gt; $merchantOrderNo,
                    'amount'            =&gt; $amount,
                    'notify_url'        =&gt; 'https://your-domain.com/pay/callback',
                    'extra'             =&gt; json_encode(['user_id' =&gt; 12345]),
                    'note'              =&gt; '在线支付',
                    'timestamp'         =&gt; time(),
                    'nonce'             =&gt; bin2hex(random_bytes(16)),
                    ];
}

                    function makeSign(array $params, string $secret): string
                    {
                      unset($params['sign']);
                    $params = array_filter($params, fn($v) =&gt; $v !== '' &amp;&amp; $v !== null);
                    ksort($params);

                    $pairs = [];
                    foreach ($params as $k =&gt; $v) {
                      $pairs[] = "{$k}={$v}";
    }
                    $signStr = implode('&amp;', $pairs);

                    return hash_hmac('sha256', $signStr, $secret);
}

                    function httpPost(string $url, array $data): array
                    {
                      $ch = curl_init($url);
                    curl_setopt_array($ch, [
                    CURLOPT_POST           =&gt; true,
                    CURLOPT_HTTPHEADER     =&gt; ['Content-Type: application/json', 'Accept: application/json'],
                    CURLOPT_POSTFIELDS     =&gt; json_encode($data),
                    CURLOPT_RETURNTRANSFER =&gt; true,
                    CURLOPT_TIMEOUT        =&gt; 30,
                    ]);
                    $body = curl_exec($ch);
                    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
                    $error = curl_error($ch);
                    curl_close($ch);

                    return [
                    'http_code' =&gt; $httpCode,
                    'body'      =&gt; $body,
                    'error'     =&gt; $error,
                    'json'      =&gt; json_decode($body, true),
                    ];
}