When initiating payments, merchants need to use the merchant API certificate to create the payment signature. We'll guide you step-by-step using test public and private keys to generate a "mini program payment" signature. We recommend testing with these keys to ensure your signature matches the document. For real transactions, use your actual parameters.
Get the merchant API certificate
We have got the merchant API certificate and stored the corresponding merchant API private key (apiclient_key.pem) locally.
Merchant ID: 202003191046
Certificate serial number: 526807E51G82219FOC2D5D3E6AB8ED1S8SDS8787AS
API certificate private key: Save the following file in PEM format. To avoid confusion with your actual public and private keys, we have saved it as apiclient_test_key.pem.
The following is a sample key and is not actually usable.
-----BEGIN PRIVATE KEY-----\\nMIIEuwIBADALBgkqhkiG9w0BAQEEggSnMIIEowIBAAKCAQEA1WFrv7DQ2FeBB2ZR\\n/bh+W/38+Rgcs/yxTdd0/9r5DWYvB6Lhc0pqaNnrmZUc+Uih6CELe1K3AAvg0+6A\\njfcLV/aqNx4xdwqfLt2P1F7TsyGJZWMe5OoPmwzel8zRpGcqY/WdmevEEFqmIc/r\\nWVa1fOCM9eIzP9QQbgT7tKXa/ixi5B5y8B0pShYJuyE2M8GimvbDbnaatMQJlwFP\\nO9fxU7cRZBdkDcUB8dMxl2ZfTHZjEC6ypR4Ux5vnPIB9hH7qHFbc6W9ueEfVRTk3\\neeoVnbmZJHliWBqtv89Tm0uMk+fD2ZayRA+TuwFajt0NTcbnM6kM0cuuyEyd7bnE\\nWFKuAwIDAQABAoIBACS+8CVEt9Jpz0iM8FW3Ldt9s9DZvCeqvoXfMsDU3srV7Adu\\nn1CRYh3IWXBLY3/yaB9ngWitZ+JUKVWV3wGTp5pwWgO/6VjMtXkGorw50E8q2VRi\\na3GUdTeIUdTmarvbIEuygn99QHhog++StL7f1cU5jkzRtW2qgWHQ7d/AKCRZA+R1\\nnUwNaQHdz2Fn5a5cQsULgNCf0Rfn4MxgsvGl3ZVcJVUiumEDfV2TDcLz2wEaWvTo\\nOhD6bN+Ug0LuucmuwC9FzR7DUNxWxmQpAdPMbAfku47K9ARqHfUjNXtBUktGdo6x\\nfmdm/fNTodSzziu4Sn87iQU0R7VU8TT2Wx1l/jECgYEA3/3yqEWSwjCY/hs+rq9O\\nrhF4vVyd8az7X+KCKiYZl51oRiRSso8dWvuVixpx3ZW8vp81K2eq9h6BmuePMVZK\\nH8PV8LbNbuLUn/cTREo7JcT0jUFSfwyMiu6De23fyCSb3fM4EFdjuywTn0d+RIr5\\nlnurFc8mRWTTX0E+kht7K50CgYEA899JYDMqs7GU+Gg8vNEHL3ux4VIGWaV0LPFj\\nn4UNn0aT3t0M+OgWm9K1tCSi5PPkmkAt8wCOtKPmSiq1CQeWa8HX+JHkMiEYO6Ki\\nHecXmZlUr/yXMhCTkkxwNsFAFxP1KYOm91+ka6w+l7/qcjan+WZsYT2XpSTx0LV5\\nPma8Hh8CgYABUNuZE3eOPnzXmU9f9VWv/hhIfH/NCKgdYxZCqyChXGJdbx8xP1f7\\nzdiODaS3mYaXVBYa4CwH8BvwzgVwU8Jxt1PNazV/vkNjgS8SyqDYUvTg045pgqhc\\ntJP/KKEU6uojfqdIqUrDsbmXyPK78lkPAkD6CtJ9u97mA1sbvp+VnQKBgFp41qba\\ntJfPZJ23RfkibtD9yaL2pCZzzCK0NqpCWShirY77YMmiiGishf5brRbVKFTVRHan\\nGUoIl/Gh4GGGMBav5ihwL0Etp+jPz+baCZZRHOrhAVJwdd7LfsHBdb5aCBSro7CY\\nCc5sKxhu+VH/1tceWUzF5dE9YHx2JpGw2U8vAoGBAL2Wp4S2dA+zKfhX7QOCLl3q\\nXYujhL1dgZBaDonWtOrn7llLSqaryD/TH8C6QRVrsXpLdwuSLx7tzQnG81ptO49Q\\nuCVFbGF5RwCf8Wq8OlYuJ/MS9GsE+Ux2EYVX3DD5zV6gtN11c7NsTEan9fRpgZjt\\n2kuvKl1oec/Rh8fbmqid\\n-----END PRIVATE KEY-----
Construct the signature string
Below is the specific format of the signature string.
The signature string consists of four lines, with each line representing a parameter. It ends with a newline character (\\n, ASCII value 0x0A), including the last line.
Mini program ID\\n
Timestamp\\n
Random string\\n
prepay_id\\n
Take calling the payment initiation API in the mini program as an example.
mpco56h12e6e52hj
Step 2: Get the current system timestamp when initiating the request. This is the total number of seconds from 00:00:00 GMT on January 1, 1970 (08:00:00 Beijing time on January 1, 1970) to the present. The superapp's payment will reject requests made a long time ago, so merchants should ensure their system time is accurate.
1$ date +%s
1742351329
Step 3: Generate a request random string.
E6F165123B4E32D8D0D6
Step 4: Get the prepay_id.
Calling the order placement API will return the prepay_id.
prepay_id=pip17423513210901nlprl31haz5fdnxqoty
Step 5: Construct the request signature string according to the rules above.
mpco56h12e6e52hj\\n
1742351329\\n
E6F165123B4E32D8D0D6\\n
pip17423513210901nlprl31haz5fdnxqoty\\n
Calculate the signature value
Most programming languages provide functions to sign data. We strongly recommend that merchants use these functions to perform SHA256 with RSA signing on the signature string using their private key, and then Base64 encode the result to get the signature value.
Below is the resulting signature value. Use verification tools to ensure your signature matches this one. If they match, the calculation is correct. If not, check the parameters and ensure there are no unintended line breaks.
uVOT92EjeLfCjQz8gXYfjgPaSVxOoAcwzalWcahkzCPw3QpAKrVmBbTa/d6hx/JfPm1ajBnLmasDRcu93f8nn2LoOMvDSkSu4T7WJW0CD2XRBdr7GN2WrIftd17iCBqOjWKgo4dIQtnx/gGThqw0UZ2zsHqtItk6N1VN+9OksDJSJF806KxBAjG+yljvjFQZ1nV6ergVWDqPJ9KghdPhILCzwQy9Vbc3jQJFKFJPJfiHdVAzoikv0rlLV/22CF4dxs0iSqLRrZuu9IbEc9JOMGXbyrxmHcwgXfe/+Rc71KHYDvqIWxhAkxvLUkJrtzWx4bwAfNyMzniN1XHthpzN3g==
Example
wx.requestPayment
(
{
"timeStamp": "1742351329",
"nonceStr": "E6F165123B4E32D8D0D6",
"package": "prepay_id=pip17423513210901nlprl31haz5fdnxqoty",
"signType": "RSA",
"paySign": "uVOT92EjeLfCjQz8gXYfjgPaSVxOoAcwzalWcahkzCPw3QpAKrVmBbTa/d6hx/JfPm1ajBnLmasDRcu93f8nn2LoOMvDSkSu4T7WJW0CD2XRBdr7GN2WrIftd17iCBqOjWKgo4dIQtnx/gGThqw0UZ2zsHqtItk6N1VN+9OksDJSJF806KxBAjG+yljvjFQZ1nV6ergVWDqPJ9KghdPhILCzwQy9Vbc3jQJFKFJPJfiHdVAzoikv0rlLV/22CF4dxs0iSqLRrZuu9IbEc9JOMGXbyrxmHcwgXfe/+Rc71KHYDvqIWxhAkxvLUkJrtzWx4bwAfNyMzniN1XHthpzN3g==",
"success":function(res){},
"fail":function(res){},
"complete":function(res){}
}
)