接口文档

// 签名算法示例（Node.js）
const crypto = require('crypto');

const merchantId = 'XXT20240001';
const appSecret  = 'sk_xxt_live_7k9m2x4q6r8t0v3w5y7z9b1d3f5h8j';
const method     = 'POST';
const path       = '/v1/id_verify';
const body       = '{"id_card":"123456789987654321","name":"测试"}';
const timestamp  = 1755587400;
const nonce      = 'a4588f2db8b8';

// 1. 计算 PathHash 和 BodyHash (SHA256 → Hex 小写)
const pathHash = crypto.createHash('sha256')
  .update(method + path, 'utf8').digest('hex');
const bodyHash = crypto.createHash('sha256')
  .update(body, 'utf8').digest('hex');

// 2. 构造签名原串 (只含字母和数字)
const signStr = merchantId + timestamp + nonce + pathHash + bodyHash;

// 3. 生成签名 (HMAC-SHA256 → Base64)
const signature = crypto.createHmac('sha256', appSecret)
  .update(signStr, 'utf8').digest('base64');

console.log({ signStr, signature });

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

// 配置
var merchantId = "XXT20240001";
var appKey = "pk_xxt_live_a3f8b2c1d9e0";
var appSecret = "sk_xxt_live_7k9m2x4q6r8t0v3w5y7z9b1d3f5h8j";
var baseUrl = "https://api.example.com";

// 请求体
var payload = new
{
    id_card = "123456789987654321",
    name = "测试"
};
var body = JsonSerializer.Serialize(payload);
var method = "POST";
var path = "/v1/id_verify";

// 签名参数
var timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();
var nonce = Convert.ToHexString(RandomNumberGenerator.GetBytes(8)).ToLowerInvariant();
var pathHash = ComputeHash(method + path);
var bodyHash = ComputeHash(body);
var signStr = $"{merchantId}{timestamp}{nonce}{pathHash}{bodyHash}";
var signature = ComputeSignature(appSecret, signStr);

// 发送请求
using var http = new HttpClient();
http.DefaultRequestHeaders.Add("X-Merchant-Id", merchantId);
http.DefaultRequestHeaders.Add("X-App-Key", appKey);
http.DefaultRequestHeaders.Add("X-Timestamp", timestamp);
http.DefaultRequestHeaders.Add("X-Nonce", nonce);
http.DefaultRequestHeaders.Add("X-Signature", signature);

var res = await http.PostAsync(baseUrl + path,
    new StringContent(body, Encoding.UTF8, "application/json"));
var resBody = await res.Content.ReadAsStringAsync();

// —— 工具函数 ——
static string ComputeHash(string input)
{
    using var sha = SHA256.Create();
    return Convert.ToHexString(sha.ComputeHash(Encoding.UTF8.GetBytes(input)))
        .ToLowerInvariant();
}
static string ComputeSignature(string key, string data)
{
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(key));
    return Convert.ToBase64String(hmac.ComputeHash(Encoding.UTF8.GetBytes(data)));
}

import java.net.URI;
import java.net.http.*;
import java.nio.charset.StandardCharsets;
import java.security.*;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

public class GatewaySignDemo {
    static final String MERCHANT_ID  = "XXT20240001";
    static final String APP_KEY      = "pk_xxt_live_a3f8b2c1d9e0";
    static final String APP_SECRET   = "sk_xxt_live_7k9m2x4q6r8t0v3w5y7z9b1d3f5h8j";
    static final String BASE_URL     = "https://api.example.com";

    static final MessageDigest SHA;
    static {
        try { SHA = MessageDigest.getInstance("SHA-256"); }
        catch (NoSuchAlgorithmException e) { throw new RuntimeException(e); }
    }

    public static String hex(byte[] b) {
        StringBuilder sb = new StringBuilder();
        for (byte x : b) sb.append(String.format("%02x", x));
        return sb.toString();
    }

    public static String sign(String key, String data) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(key.getBytes(), "HmacSHA256"));
        return Base64.getEncoder().encodeToString(mac.doFinal(data.getBytes()));
    }

    public static void main(String[] args) throws Exception {
        String method = "POST";
        String path   = "/v1/id_verify";
        String body   = "{\"id_card\":\"123456789987654321\",\"name\":\"测试\"}";

        String timestamp = String.valueOf(System.currentTimeMillis() / 1000);
        SecureRandom r   = new SecureRandom();
        String nonce     = String.format("%016x", new java.math.BigInteger(64, r));

        String pathHash = hex(SHA.digest((method + path).getBytes(StandardCharsets.UTF_8)));
        String bodyHash = hex(SHA.digest(body.getBytes(StandardCharsets.UTF_8)));
        String signStr  = MERCHANT_ID + timestamp + nonce + pathHash + bodyHash;
        String signature = sign(APP_SECRET, signStr);

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest req = HttpRequest.newBuilder()
            .uri(URI.create(BASE_URL + path))
            .header("Content-Type", "application/json")
            .header("X-Merchant-Id", MERCHANT_ID)
            .header("X-App-Key", APP_KEY)
            .header("X-Timestamp", timestamp)
            .header("X-Nonce", nonce)
            .header("X-Signature", signature)
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse resp = client.send(req, HttpResponse.BodyHandlers.ofString());
        System.out.println(resp.body());
    }
}