接入手册

curl -X POST https://api-sandbox.nayunfu.cn/api/v1/merchant/orders \
  -H 'Content-Type: application/json' \
  -d '{
    "app_id": "ap_sandbox_8f2c41",
    "out_trade_no": "AI202601080001",
    "amount": "19.90",
    "subject": "AI 绘画 100 次额度",
    "channel_code": "sandbox_qr",
    "notify_url": "https://your-app.com/napay/notify",
    "expires_in": 900,
    "timestamp": 1767838471,
    "nonce": "9d4c1f7b2a6e",
    "sign": "a3f1c9…"
  }'

amount=19.90&app_id=ap_sandbox_8f2c41&channel_code=sandbox_qr&expires_in=900
&nonce=9d4c1f7b2a6e&notify_url=https://your-app.com/napay/notify
&out_trade_no=AI202601080001&subject=AI 绘画 100 次额度&timestamp=1767838471

import crypto from 'node:crypto';

const BASE = 'https://api-sandbox.nayunfu.cn/api/v1';
const APP_ID = 'ap_sandbox_8f2c41';
const SECRET = process.env.NAPAY_APP_SECRET;

// stringA：非空字段按 key 升序拼接，排除 sign
function stringA(p) {
  return Object.keys(p)
    .filter(k => k !== 'sign' && p[k] !== '' && p[k] != null)
    .sort()
    .map(k => `${k}=${typeof p[k] === 'object' ? JSON.stringify(p[k]) : p[k]}`)
    .join('&');
}

function sign(p) {
  return crypto.createHmac('sha256', SECRET).update(stringA(p), 'utf8').digest('hex');
}

const body = {
  app_id: APP_ID,
  out_trade_no: 'AI202601080001',
  amount: '19.90',
  subject: 'AI 绘画 100 次额度',
  channel_code: 'sandbox_qr',
  notify_url: 'https://your-app.com/napay/notify',
  expires_in: 900,
  timestamp: Math.floor(Date.now() / 1000),
  nonce: crypto.randomBytes(6).toString('hex')
};
body.sign = sign(body);

const res = await fetch(`${BASE}/merchant/orders`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
});
const { data } = await res.json();
console.log(data.trade_no, data.checkout_url);

import hmac, hashlib, json, time

def string_a(payload: dict) -> str:
    items = []
    for k in sorted(payload):
        if k == "sign":
            continue
        v = payload[k]
        if v is None or v == "":
            continue
        if isinstance(v, (dict, list)):
            v = json.dumps(v, separators=(",", ":"), sort_keys=True, ensure_ascii=False)
        items.append(f"{k}={v}")
    return "&".join(items)

def verify(payload: dict, secret: str) -> bool:
    if abs(time.time() - int(payload["timestamp"])) > 300:
        return False                      # 时间戳超出允许偏差
    expect = hmac.new(secret.encode(), string_a(payload).encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expect, payload.get("sign", ""))

{
  "code": 0,
  "message": "ok",
  "request_id": "req_01HQ8F3M7X",       // 提工单时带上这个
  "data": {
    "trade_no": "NP-2601-0001",        // 平台订单号
    "out_trade_no": "AI202601080001",
    "status": "created",
    "amount": "19.90",
    "checkout_url": "https://pay-sandbox.nayunfu.cn/c/NP-2601-0001",
    "expires_at": "2026-01-08T10:39:31+08:00"
  }
}

{
  "app_id": "ap_sandbox_8f2c41",
  "event": "payment.succeeded",
  "trade_no": "NP-2601-0001",
  "out_trade_no": "AI202601080001",
  "channel_code": "sandbox_qr",
  "amount": "19.90",
  "fee": "0.32",                   // 19.90 × 1.6%，四舍五入到分
  "settle_amount": "19.58",          // 商户实收
  "paid_at": "2026-01-08T10:24:31+08:00",
  "timestamp": 1767838471,
  "nonce": "9d4c1f7b2a6e",
  "sign": "a3f1c9…"
}

NAPAY 钠云付 v1 支付接口摘要（用于生成对接代码）

BASE_SANDBOX = https://api-sandbox.nayunfu.cn/api/v1
BASE_LIVE    = https://api.nayunfu.cn/api/v1
AUTH         = 报文内签名，无 Bearer token
CREDENTIALS  = app_id（可公开） + app_secret（仅服务端）

SIGN
  1. 取报文全部非空字段，排除 sign
  2. key 按 ASCII 升序，拼 "k=v"，以 & 连接 -> stringA（值不做 URL 编码）
  3. 嵌套对象取紧凑 JSON：无空格、key 升序、中文不转义
  4. sign = hex_lower(HMAC_SHA256(stringA, app_secret))
  5. 验签用常量时间比较；timestamp 容差 ±300s；nonce 5 分钟去重

CREATE ORDER  POST /merchant/orders
  必填 app_id, out_trade_no, amount(string,2dp), subject, channel_code,
       notify_url(https), timestamp(sec), nonce, sign
  可选 currency(CNY), expires_in(300-7200,默认900), return_url, description,
       metadata(object,<=20 键,值为字符串)
  返回 code=0, request_id, data{trade_no, status=created, checkout_url, expires_at}
  幂等 同 out_trade_no + 同金额 24h 内返回原订单；金额不同报 40009

QUERY   GET  /merchant/orders/{trade_no} 或 ?out_trade_no=xxx（签名字段放 query）
CLOSE   POST /merchant/orders/{trade_no}/close（仅 created 可关）
RETRY   POST /merchant/notifications/{trade_no}/retry

WEBHOOK POST notify_url，JSON，字段：
  app_id, event, trade_no, out_trade_no, channel_code, amount, fee,
  settle_amount, paid_at, timestamp, nonce, sign
  event: payment.succeeded | order.closed
  处理顺序：验签 -> 核对 out_trade_no 与 amount -> 按 trade_no 幂等 -> 发货
  响应：5 秒内返回纯文本 success；失败重推 7 次（0s,15s,1m,5m,15m,1h,3h）

STATE   created -> paid -> notified -> reconciled；终止态 closed
FEE     交易费率 1.6%，settle_amount = amount - fee；接口调用不计费
ERRORS  40001 参数 / 40009 订单号重复 / 40100 验签失败 / 40101 时间戳 /
        40102 nonce 重复 / 40300 通道未开通 / 40400 订单不存在 /
        40900 状态不允许 / 42900 限流 / 50000 内部错误(可重试) /
        50200 通道不可用(可重试)

约定  金额一律字符串两位小数，禁止 float；支付结果只认回调，不认前端跳转；
      沙箱 channel_code = sandbox_qr，不涉及真实资金。