Pay Notify WebHook API

NOTE

If the notifyurl parameter is passed, onlinepay will notify the address of the payment result

What You Receive

POST your notifyUrl
Content-Type: application/json

{
  "encryptedData": "SFOs0qSAGLs6kHLfWi3nmhczH4T+zwv...",
  "encryptedKey": "Vfn2M+u4uG7nWklk2UuZLEC9RL9YqU7s...",
  "signType": "RSA256"
}

Step 1: Decrypt

// 1. RSA decrypt encryptedKey with OnlinePay Public Key → get AES key
// 2. AES decrypt encryptedData with AES key → get plaintext JSON below

Step 2: Decrypted Fields

Parameter	Type	Required	Description
tradeNo	string	Yes	The flow number generated after each order payment (unique marker)
merOrderNo	string	Yes	Corresponds to the [OrderNo] parameter of the order submission parameter
code	string	No	Payment result (0: payment successful 1: payment failed 2: pending 3: waiting for suppling information)
message	string	Yes	Description of Payment Result
cardNo	string	No	Masked card number
receiveAmount	string	No	Receive amount for payment (used for CryptoPay and SEPA)
txHash	string	No	Transaction hash (used for CryptoPay)
counterpartyAccountName	string	No	The account name of transferor (used for SEPA)
counterpartyAccountNum	string	No	The account number of transferor (used for SEPA)
signType	string	Yes	`MD5` or `RSA256`
sign	string	Yes	Signature value

Decrypted JSON Example

{
  "tradeNo": "T202309011234567890",
  "merOrderNo": "MER20230901001",
  "code": "0",
  "message": "success",
  "cardNo": "411111****1111",
  "signType": "RSA256",
  "sign": "a3f8e2d1..."
}

Step 3: Verify Signature

Sort all fields by key (exclude sign, signType, skip null/empty)

Join as key1=value1&key2=value2

Verify by signType:

MD5: MD5(signString + md5Key).toUpperCase() == sign

RSA256: RSA-SHA256-Verify(signString, sign, OnlinePay_PublicKey)

Example

Fields: tradeNo, merOrderNo, code, message, cardNo
Sign string: cardNo=411111****1111&code=0&merOrderNo=MER20230901001&message=success&tradeNo=T202309011234567890

Step 4: Respond

Return HTTP 200 to acknowledge receipt.

HTTP/1.1 200 OK
Content-Type: text/plain

success

Request Code Samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

What You Receive#

Step 1: Decrypt#

Step 2: Decrypted Fields#

Decrypted JSON Example#

Step 3: Verify Signature#

Example#

Step 4: Respond#

Request

Request Code Samples

Responses

What You Receive

Step 1: Decrypt

Step 2: Decrypted Fields

Decrypted JSON Example

Step 3: Verify Signature

Example

Step 4: Respond