交易订单回调

POST {您配置的回调地址}

Content-Type: application/json

{
  "accountId": "132456789",
  "data": {
    "id": "a7787ada1123-xxxx-uuuuu-sssss",
    "cardNum": "5572710152044****",
    "type": "Consumption",
    "status": "Pending",
    "amount": "-25.50",
    "merchantName": "Amazon",
    "transactionId": "TXN20231201123456",
    "recordTime": "2023-12-01T10:30:00.000+00:00",
    "remark": "在线购物"
  },
  "timestamp": "1701424200000",
  "sign": "ABC123DEF456..."
}

function verifyWebhookSign(requestBody, secretKey) {
  const { sign, ...params } = requestBody;

  // 展开 data 对象
  const { data, accountId, timestamp } = params;
  const allParams = { accountId, timestamp, ...data };

  // 按 ASCII 排序并构建字符串
  const sortedKeys = Object.keys(allParams).sort();
  const stringA = sortedKeys
    .map(key => `${key}=${encodeURIComponent(allParams[key])}`)
    .join('&')
    .replace(/\+/g, '%20');

  // 拼接密钥并计算 MD5
  const stringSignTemp = `${stringA}&key=${secretKey}`;
  const calculatedSign = md5(stringSignTemp).toUpperCase();

  return calculatedSign === sign;
}

import hashlib
from urllib.parse import quote

def verify_webhook_sign(request_body, secret_key):
    sign = request_body.pop('sign')

    # 展开 data 对象
    data = request_body.pop('data')
    all_params = {
        'accountId': request_body['accountId'],
        'timestamp': request_body['timestamp'],
        **data
    }

    # 按 ASCII 排序
    sorted_keys = sorted(all_params.keys())
    string_a = '&'.join([
        f"{key}={quote(str(all_params[key]))}"
        for key in sorted_keys
    ]).replace('+', '%20')

    # 拼接密钥并计算 MD5
    string_sign_temp = f"{string_a}&key={secret_key}"
    calculated_sign = hashlib.md5(
        string_sign_temp.encode()
    ).hexdigest().upper()

    return calculated_sign == sign

{
  "code": 0,
  "msg": "success"
}

{
  "code": 1,
  "msg": "error message"
}

// Express.js 示例
app.post('/webhook/vcc', async (req, res) => {
  try {
    // 1. 验证签名
    if (!verifyWebhookSign(req.body, SECRET_KEY)) {
      return res.status(403).json({ code: 1, msg: '签名验证失败' });
    }

    // 2. 检查是否已处理（幂等性）
    const { id } = req.body.data;
    if (await isProcessed(id)) {
      return res.json({ code: 0, msg: 'success' });
    }

    // 3. 快速响应
    res.json({ code: 0, msg: 'success' });

    // 4. 异步处理业务逻辑
    processTransactionAsync(req.body.data);

  } catch (error) {
    console.error('Webhook error:', error);
    res.status(500).json({ code: 1, msg: '处理失败' });
  }
});