接入指南

curl -X POST https://api.cnixpay.com/api/v2/orders \
  -H "Authorization: Bearer $CNIXPAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "merchantOrderNo": "ORDER_10086",
  "amount": "100.00",
  "paymentOptions": [
    { "chain": "tron", "token": "USDT" },
    { "chain": "bsc",  "token": "USDC" }
  ],
  "callbackUrl": "https://shop.example.com/notify"
}'

import os
import requests

resp = requests.post(
    "https://api.cnixpay.com/api/v2/orders",
    headers={"Authorization": f"Bearer {os.environ['CNIXPAY_API_KEY']}"},
    json={
        "merchantOrderNo": "ORDER_10086",
        "amount": "100.00",  # 金额必须是字符串
        "paymentOptions": [{"chain": "tron", "token": "USDT"}, {"chain": "bsc", "token": "USDC"}],
        "callbackUrl": "https://shop.example.com/notify",
    },
    timeout=10,
)
body = resp.json()
if body["code"] != 0:
    raise RuntimeError(f"{body['code']} {body['message']} (requestId={body['requestId']})")
order = body["data"]

const res = await fetch('https://api.cnixpay.com/api/v2/orders', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.CNIXPAY_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    merchantOrderNo: 'ORDER_10086',
    amount: '100.00', // 金额必须是字符串
    paymentOptions: [{ chain: 'tron', token: 'USDT' }, { chain: 'bsc', token: 'USDC' }],
    callbackUrl: 'https://shop.example.com/notify',
  }),
})
const body = await res.json()
if (body.code !== 0) throw new Error(`${body.code} ${body.message} (requestId=${body.requestId})`)
const order = body.data

$ch = curl_init('https://api.cnixpay.com/api/v2/orders');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 10,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('CNIXPAY_API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'merchantOrderNo' => 'ORDER_10086',
        'amount' => '100.00', // 金额必须是字符串
        'paymentOptions' => [['chain' => 'tron', 'token' => 'USDT'], ['chain' => 'bsc', 'token' => 'USDC']],
        'callbackUrl' => 'https://shop.example.com/notify',
    ]),
]);
$body = json_decode(curl_exec($ch), true);
if ($body['code'] !== 0) {
    throw new RuntimeException("{$body['code']} {$body['message']} (requestId={$body['requestId']})");
}
$order = $body['data'];

payload := strings.NewReader(`{
  "merchantOrderNo": "ORDER_10086",
  "amount": "100.00",
  "paymentOptions": [{"chain": "tron", "token": "USDT"}, {"chain": "bsc", "token": "USDC"}],
  "callbackUrl": "https://shop.example.com/notify"
}`)
req, _ := http.NewRequest(http.MethodPost, "https://api.cnixpay.com/api/v2/orders", payload)
req.Header.Set("Authorization", "Bearer "+os.Getenv("CNIXPAY_API_KEY"))
req.Header.Set("Content-Type", "application/json")

resp, err := http.DefaultClient.Do(req)
if err != nil {
	return err
}
defer resp.Body.Close()

var body struct {
	Code      int             `json:"code"`
	Message   string          `json:"message"`
	Data      json.RawMessage `json:"data"`
	RequestID string          `json:"requestId"`
}
if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
	return err
}
if body.Code != 0 {
	return fmt.Errorf("%d %s (requestId=%s)", body.Code, body.Message, body.RequestID)
}

String json = """
    {
      "merchantOrderNo": "ORDER_10086",
      "amount": "100.00",
      "paymentOptions": [{"chain": "tron", "token": "USDT"}, {"chain": "bsc", "token": "USDC"}],
      "callbackUrl": "https://shop.example.com/notify"
    }""";
HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.cnixpay.com/api/v2/orders"))
    .header("Authorization", "Bearer " + System.getenv("CNIXPAY_API_KEY"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(json))
    .build();
HttpResponse<String> response = HttpClient.newHttpClient()
    .send(request, HttpResponse.BodyHandlers.ofString());
// 解析 JSON：code == 0 为成功，data 为订单对象；失败时记录 requestId

import crypto from 'node:crypto'

// rawBody 必须是原始请求体（Buffer），不要先解析成 JSON 再序列化
export function verifyWebhook(rawBody, headers, apiSecret) {
  const timestamp = headers['x-webhook-timestamp']
  const signature = headers['x-webhook-signature'] ?? ''
  if (!/^\d+$/.test(timestamp ?? '') || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false
  const expected =
    'v2=' + crypto.createHmac('sha256', apiSecret).update(`${timestamp}.`).update(rawBody).digest('hex')
  const a = Buffer.from(expected)
  const b = Buffer.from(signature)
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}

// Express: app.post('/notify', express.raw({ type: 'application/json' }), handler)

import hashlib
import hmac
import time


def verify_webhook(raw_body: bytes, headers, api_secret: str) -> bool:
    timestamp = headers.get("X-Webhook-Timestamp", "")
    signature = headers.get("X-Webhook-Signature", "")
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > 300:
        return False
    expected = "v2=" + hmac.new(
        api_secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

func VerifyWebhook(r *http.Request, rawBody []byte, apiSecret string) bool {
	timestamp := r.Header.Get("X-Webhook-Timestamp")
	sec, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil || time.Since(time.Unix(sec, 0)).Abs() > 5*time.Minute {
		return false
	}
	mac := hmac.New(sha256.New, []byte(apiSecret))
	mac.Write([]byte(timestamp + "."))
	mac.Write(rawBody)
	expected := "v2=" + hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(expected), []byte(r.Header.Get("X-Webhook-Signature")))
}

function verifyWebhook(string $rawBody, string $timestamp, string $signature, string $apiSecret): bool
{
    if (!ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) {
        return false;
    }
    $expected = 'v2=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $apiSecret);
    return hash_equals($expected, $signature);
}

// $raw = file_get_contents('php://input');
// verifyWebhook($raw, $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '', $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '', $secret);

static boolean verifyWebhook(byte[] rawBody, String timestamp, String signature, String apiSecret)
        throws GeneralSecurityException {
    long ts;
    try {
        ts = Long.parseLong(timestamp);
    } catch (NumberFormatException e) {
        return false;
    }
    if (Math.abs(System.currentTimeMillis() / 1000 - ts) > 300) return false;

    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(apiSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    mac.update((timestamp + ".").getBytes(StandardCharsets.UTF_8));
    String expected = "v2=" + HexFormat.of().formatHex(mac.doFinal(rawBody));
    return MessageDigest.isEqual(
        expected.getBytes(StandardCharsets.UTF_8), signature.getBytes(StandardCharsets.UTF_8));
}