For an API request whose HTTP method is GET, if the request URL involves parameter concatenation, it is recommended that the complete request URL after concatenation not contain special characters. If necessary, you are advised to encode special characters in the URL. Special characters in URLs include but are not limited to the following: plus sign (+), space, question mark (?), percent sign (%), number sign (#), ampersand (&), and equal sign (=).

Authentication and Authorization

Authentication: confirms the identity of the caller to prevent repudiation and data tampering. For all APIs open to merchants, the merchants must pass the PayMercAuth field in the request header. The subsequent process can be performed only after the authentication of the open gateway is passed.
Authorization: ensures that only specific callers have permissions to call given APIs. Some APIs can be used only after specific merchants apply for and enable them.

Signing Rules

Signing scenario: parameter signature in the header of a request from the merchant cloud.

Signature algorithm: SHA256WithRSA/PSS or SM2.

Development procedure

Filtering: Exclude the sign field from the JSON string in the request and retain only other fields.
Sorting and concatenation: Sort the fields by ASCII code of key values and use & to concatenate them. In list scenarios, use the equal sign (=) to concatenate them.

For details, see the signString method of the SignStringUtil.java class in Maven dependency (pay-java) provided by Huawei Pay in the sample code. The following is an example of the sorting and concatenation result:
```
"allocationType=DELAY_ORDER_ALLOCATION&callbackUrl=https://www.xxxxxx.com/hw/pay/callback&currency=CNY&mercNo=xxxxxx&mercOrderNo=xxxxxx&totalAmount=2&tradeSummary=Magazine and newspaper"
```

Signing: Call the given algorithm to sign the sorted string.

SHA256WithRSA/PSS: For details, see the signByRSAWithPSS method of the RSAUtils.java class in Maven dependency (pay-java) provided by Huawei Pay in the sample code.

SM2: For details, see the sign method of the Sm2Utils.java class in Maven dependency (pay-java).

Reference for the signed content:

POST request: POST https://petalpay-developer.cloud.huawei.com.cn/api/v2/aggr/preorder/create/app
{
    "appId": "5765880207854262xxx",
    "callbackUrl": "https://www.xxx.com/hw_notify",
    "currency": "CNY",
    "mercNo": "101723200xxx",
    "mercOrderNo": "2405171027547xxx",
    "payload": "shop|h8ahnJA8xxRXVw",
    "totalAmount": 5,
    "tradeSummary": "test",
    "subOrders": [
      {
        "mercNo": "101723200xxx",
        "mercOrderNo": "abcxxx1"
      },
      {
        "mercNo": "101723201xxx",
        "mercOrderNo": "abcxxx2"
      }
    ]
}
Signed content: appId=5765880207854262xxx&callbackUrl=https://www.xxx.com/hw_notify&currency=CNY&mercNo=101723200xxx&mercOrderNo=2405171027547xxx&payload=shop|h8ahnJA8xxRXVw&subOrders=mercNo=101723200xxx&mercOrderNo=abcxxx1,mercNo=101723201xxx&mercOrderNo=abcxxx2&totalAmount=5&tradeSummary=test

GET request: GET https://petalpay-developer.cloud.huawei.com.cn/api/v2/aggr/transactions/merc-orders/20240507000000041809599950090xxx?mercNo=101540000089&sdkVersion=1.0.0
Signed content: /api/v2/aggr/transactions/merc-orders/20240507000000041809599950090xxx?mercNo=101540000089&sdkVersion=1.0.0

If a field is set to null, the field cannot be signed. If a field is set to an empty string, the field must be signed.

[h2]Sample Code for Signing with SHA256WithRSA/PSS in Common Languages

Sample code for signing:

// Example for sorting and concatenation
import (
    "encoding/base64"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "sort"
    "strings"
)

// Generate a string to be signed using GenerateSignData.
// Step 1: Exclude the sign field.
// Step 2: Sort the fields by ASCII code of key values and use & to concatenate them.
func (s *SignatureUtils) GenerateSignData(params map[string]interface{}) string {
    return s.buildSignData(params)
}
// Recursively build a to-be-signed string using buildSignData.
func (s *SignatureUtils) buildSignData(params interface{}) string {
    switch v := params.(type) {
    case map[string]interface{}:
        return s.buildMapSignData(v)
    case []interface{}:
        return s.buildArraySignData(v)
    default:
        return fmt.Sprintf("%v", v)
    }
}
// Use buildMapSignData to process data of the Map type.
func (s *SignatureUtils) buildMapSignData(params map[string]interface{}) string {
    // Sort keys.
    var keys []string
    for k := range params {
        // Exclude the sign field.
        if k == "sign" {
            continue
        }
        keys = append(keys, k)
    }
    sort.Strings(keys)
    var parts []string
    for _, key := range keys {
        value := params[key]
        // The null value is not involved in signing.
        if value == nil {
            continue
        }
        // The empty string is involved in signing.
        strValue := s.buildSignData(value)
        parts = append(parts, fmt.Sprintf("%s=%s", key, strValue))
    }
    return strings.Join(parts, "&")
}
// Use buildArraySignData to process data of the array type.
func (s *SignatureUtils) buildArraySignData(arr []interface{}) string {
    var parts []string
    for _, item := range arr {
        if item == nil {
            continue
        }
        parts = append(parts, s.buildSignData(item))
    }
    return strings.Join(parts, ",")
}

// Signing example
package main
import (
  "crypto"
  "crypto/rand"
  "crypto/rsa"
  "crypto/sha256"
  "crypto/x509"
  "encoding/base64"
  "fmt"
  "testing"
)
func signSha256WithRsaPSS(message, privateKeyStr string) (string, error) {
  privateKey, err := getPrivateKey(privateKeyStr)
  if err != nil {
    return "", err
  }
  hasher := sha256.New()
  hasher.Write([]byte(message))
  hashedMessage := hasher.Sum(nil)
  opts := rsa.PSSOptions{
    SaltLength: rsa.PSSSaltLengthEqualsHash,
    Hash:       crypto.SHA256,
  }
  signature, err := rsa.SignPSS(rand.Reader, privateKey, crypto.SHA256, hashedMessage, &opts)
  if err != nil {
    return "", err
  }
  return base64.StdEncoding.EncodeToString(signature), nil
}

func getPrivateKey(privateKeyStr string) (*rsa.PrivateKey, error) {
  decoded, err := base64.StdEncoding.DecodeString(privateKeyStr)
  if err != nil {
    return nil, err
  }
  privateKey, err := x509.ParsePKCS8PrivateKey(decoded)
  if err != nil {
    return nil, err
  }
  rsaPrivateKey, ok := privateKey.(*rsa.PrivateKey)
  if !ok {
  return nil, err
  }
  return rsaPrivateKey, nil
}

func TestRsaSign(t *testing.T) {
  signature, err := signSha256WithRsaPSS("Sign the sorted and concatenated content","Private key")
  fmt.Println(signature, err)
}

JavaScript

JavaScript implements signing using the jsrsasign module. If the Node .js environment has been installed, run the following command to install the jsrsasign module:

npm install jsrsasign

Sample code for signing:

// Example for sorting and concatenation
/**
 * Recursively build a to-be-signed string.
 * @param {*} data Pointer to the data.
 * @returns {string} String to be signed.
 */
buildSignData(data) {
    if (data === null || data === undefined) {
        return '';
    }
    if (typeof data === 'object' && !Array.isArray(data)) {
        return this.buildMapSignData(data);
    }
    if (Array.isArray(data)) {
        return this.buildArraySignData(data);
    }
    return String(data);
}
/**
 * Process data of the Map type.
 * @param {Object} params Parameter object.
 * @returns {string} String to be signed.
 */
buildMapSignData(params) {
    // Sort keys.
    const keys = Object.keys(params)
        .filter(key => key !== 'sign') // Exclude the sign field.
        .sort();
    const parts = [];
    for (const key of keys) {
        const value = params[key];
        // The null value is not involved in signing.
        if (value === null || value === undefined) {
            continue;
        }
        // The empty string is involved in signing.
        const strValue = this.buildSignData(value);
        parts.push(`${key}=${strValue}`);
    }
    return parts.join('&');
}
/**
 * Process data of the array type.
 * @param {Array} arr Array.
 * @returns {string} String to be signed.
 */
buildArraySignData(arr) {
    const parts = [];
    for (const item of arr) {
        if (item === null || item === undefined) {
            continue;
        }
        parts.push(this.buildSignData(item));
    }
    return parts.join(',');
}

// Signing example
const jsrsasign = require('jsrsasign');
function signSha256WithRsaPSS(plainData, privateStr) {
  let rsa = new jsrsasign.RSAKey();
  // Private key in PEM format.
  const priKey = `-----BEGIN PRIVATE KEY-----\n${privateStr}\n-----END PRIVATE KEY-----\n`;
  rsa = jsrsasign.KEYUTIL.getKey(priKey);
  const sig = new jsrsasign.KJUR.crypto.Signature({
    alg: 'SHA256withRSAandMGF1',
  });
  sig.init(rsa);
  sig.updateString(plainData);
  return jsrsasign.hextob64(sig.sign());
}
let signature = signSha256WithRsaPSS("Sign the sorted and concatenated content","Private key")
console.info(signature)

Python

Python implements signing using the cryptography module. You can run the following command to install the cryptography module:

pip install cryptography

Sample code for signing:

# Example for sorting and concatenation
def generate_sign_data(self, params):
    """
    Generate a string to be signed.
    Step 1: Exclude the sign field.
    Step 2: Sort the fields by ASCII code of key values and use & to concatenate them.
    Args:
        params: Parameter dictionary.
    Returns:
        str: String to be signed.
    """
    return self._build_sign_data(params)
def _build_sign_data(self, data):
    """
    Recursively build a to-be-signed string.
    Args:
        data: Data.
    Returns:
        str: String to be signed.
    """
    if data is None:
        return ''
    if isinstance(data, dict):
        return self._build_map_sign_data(data)
    if isinstance(data, (list, tuple)):
        return self._build_array_sign_data(data)
    return str(data)
def _build_map_sign_data(self, params):
    """
    Process data of the dictionary type.
    Args:
        params: Parameter dictionary.
    Returns:
        str: String to be signed.
    """
    # Sort the keys and exclude the sign field.
    keys = sorted([k for k in params.keys() if k != 'sign'])
    parts = []
    for key in keys:
        value = params[key]
        # The None value is not involved in signing.
        if value is None:
            continue
        # The empty string is involved in signing.
        str_value = self._build_sign_data(value)
        parts.append(f"{key}={str_value}")
    return '&'.join(parts)
def _build_array_sign_data(self, arr):
    """
    Process data of the array type.
    Args:
        arr: Array.
    Returns:
        str: String to be signed.
    """
    parts = []
    for item in arr:
        if item is None:
            continue
        parts.append(self._build_sign_data(item))
    return ','.join(parts)

# Signing example
import base64

from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.serialization import load_pem_private_key, load_pem_public_key

def signSha256WithRsaPSS(private_key_str, message):
    # Private key in PEM format.
    prikey_content = "-----BEGIN PRIVATE KEY-----\n" + private_key_str +"\n-----END PRIVATE KEY-----\n";
    private_key = load_pem_private_key(data=prikey_content.encode("utf-8"), password=None, backend=default_backend())

    # Use the RSA-PSS algorithm to generate a signature.
    signature = private_key.sign(
        message.encode("utf-8"),
        padding.PSS(
            mgf=padding.MGF1(hashes.SHA256()),
            salt_length=padding.PSS.DIGEST_LENGTH
        ),
        hashes.SHA256()
    )
    return base64.b64encode(signature).decode('utf-8')

message = "Sign the sorted and concatenated content"
private_key_str = "Private key"
signature = signSha256WithRsaPSS(private_key_str, message)
print(signature)

PHP

PHP implements signing using the phpseclib encryption library. If the composer environment has been installed, you can run the following command to import phpseclib:

composer require phpseclib/phpseclib

Sample code for signing:

// Example for sorting and concatenation
class SignatureUtils
{
    /**
     * Generate a string to be signed.
     * Step 1: Exclude the sign field.
     * Step 2: Sort the fields by ASCII code of key values and use & to concatenate them.
     *
     * @param array $params Parameter array.
     * @return string String to be signed.
     */
    public function generateSignData($params)
    {
        return $this->buildSignData($params);
    }
    /**
     * Recursively build a to-be-signed string.
     *
     * @param mixed $data Data.
     * @return string String to be signed.
     */
    private function buildSignData($data)
    {
        if ($data === null) {
            return '';
        }
        if (is_array($data)) {
            // Check whether the array is an associative array (Map).
            if ($this->isAssocArray($data)) {
                return $this->buildMapSignData($data);
            } else {
                return $this->buildArraySignData($data);
            }
        }
        return (string)$data;
    }
    /**
     * Check whether the array is an associative array.
     *
     * @param array $arr Array.
     * @return bool
     */
    private function isAssocArray($arr)
    {
        if (empty($arr)) {
            return false;
        }
        return array_keys($arr) !== range(0, count($arr) - 1);
    }
    /**
     * Process data of the Map type.
     *
     * @param array $params Parameter array.
     * @return string String to be signed.
     */
    private function buildMapSignData($params)
    {
        // Sort the keys and exclude the sign field.
        $keys = array_keys($params);
        $keys = array_filter($keys, function($key) {
            return $key !== 'sign';
        });
        sort($keys);
        $parts = [];
        foreach ($keys as $key) {
            $value = $params[$key];
            // The null value is not involved in signing.
            if ($value === null) {
                continue;
            }
            // The empty string is involved in signing.
            $strValue = $this->buildSignData($value);
            $parts[] = $key . '=' . $strValue;
        }
        return implode('&', $parts);
    }
    /**
     * Process data of the array type.
     *
     * @param array $arr Array.
     * @return string String to be signed.
     */
    private function buildArraySignData($arr)
    {
        $parts = [];
        foreach ($arr as $item) {
            if ($item === null) {
                continue;
            }
            $parts[] = $this->buildSignData($item);
        }
        return implode(',', $parts);
    }
    /**
     * Convert Base64 to Hex.
     *
     * @param string $base64String Base64 string.
     * @return string Hexadecimal string.
     */
    private function base64ToHex($base64String)
    {
        $bytes = base64_decode($base64String);
        return bin2hex($bytes);
    }
    /**
     * Parse a JSON string as an array.
     *
     * @param string $jsonStr JSON string.
     * @return array Array.
     */
    public function parseJSON($jsonStr)
    {
        return json_decode($jsonStr, true);
    }
    /**
     * Generate a string to be signed from the JSON string.
     *
     * @param string $jsonStr JSON string.
     * @return string String to be signed.
     */
    public function generateSignDataFromJSON($jsonStr)
    {
        $params = $this->parseJSON($jsonStr);
        return $this->generateSignData($params);
    }
    public function testExcludeSignField()
    {
        $params = [
            'appId' => '5765880207854262xxx',
            'callbackUrl' => 'https://www.xxx.com/hw_notify',
            'sign' => 'xxxxx', // The sign field should be excluded.
            'currency' => 'CNY'
        ];
        $signData = $this-> generateSignData($params);
        echo "[testExcludeSignField] Sign data without sign field: " . $signData . "\n";
    }
}

// Signing example
<?php
require_once 'vendor/autoload.php';
use phpseclib\Crypt\RSA;

function signSha256WithRsaPSS($content, $privateKeyStr) {
    try {
        $privateKey = "-----BEGIN PRIVATE KEY-----\n" . $privateKeyStr ."\n-----END PRIVATE KEY-----";
        $signer = new \phpseclib\Crypt\RSA();
        $signer->loadKey($privateKey, $password = false);
        $signer->setHash('sha256');
        $signer->setSignatureMode(RSA::SIGNATURE_PSS);
        $signer->setMGFHash('sha256');
        $signature = $signer->sign($content);

        $sign = base64_encode($signature);
        return $sign;
    } catch (Exception $e) {
        echo $e->getMessage();
    }
    return null;
}
$data = "Sign the sorted and concatenated content";
$privateKeyStr = "Private key";
echo signSha256WithRsaPSS($data, $privateKeyStr)
?>

Sample code for signing:

<?php
require_once 'vendor/autoload.php';

use phpseclib3\Crypt\PublicKeyLoader;
use phpseclib3\Crypt\RSA;

function signSha256WithRsaPSS($data,$rsa_key){
    $key = "-----BEGIN PRIVATE KEY-----\n" . $rsa_key . "-----END PRIVATE KEY-----";
    $private = PublicKeyLoader::load($key, $password = false);
    $private = $private->withPadding(RSA::SIGNATURE_PSS);
    return base64_encode($private->sign($data));
}

$data = "Sign the sorted and concatenated content";
$privateKeyStr = "Private key";
echo signSha256WithRsaPSS($data, $privateKeyStr);
?>

C# can implement signing using the BouncyCastle library. If you have installed .NET SDK, run the following command to add BouncyCastle:

dotnet add package BouncyCastle

Sample code for signing:

// Example for sorting and concatenation
using System;
using System.Collections.Generic;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Linq;
namespace PaySignature
{
    /// <summary>
    /// Signature utilities.
    /// </summary>
    public class SignatureUtils
    {
        /// <summary>
        /// Generate a string to be signed.
        /// Step 1: Exclude the sign field.
        /// Step 2: Sort the fields by ASCII code of key values and use & to concatenate them.
        /// </summary>
        /// <param name="params">Parameter dictionary</param>
        /// <returns>String to be signed</returns>
        public string GenerateSignData(Dictionary<string, object> parameters)
        {
            return BuildSignData(parameters);
        }
        /// <summary>
        /// Recursively build a to-be-signed string.
        /// </summary>
        /// <param name="data">Data</param>
        /// <returns>String to be signed</returns>
        private string BuildSignData(object data)
        {
            if (data == null)
            {
                return string.Empty;
            }
            if (data is Dictionary<string, object> dict)
            {
                return BuildMapSignData(dict);
            }
            if (data is List<object> list)
            {
                return BuildArraySignData(list);
            }
            return data.ToString();
        }
        /// <summary>
        /// Process data of the dictionary type.
        /// </summary>
        /// <param name="parameters">Parameter dictionary</param>
        /// <returns>String to be signed</returns>
        private string BuildMapSignData(Dictionary<string, object> parameters)
        {
            // Sort the keys and exclude the sign field.
            var keys = parameters.Keys
                .Where(k => k != "sign")
                .OrderBy(k => k, StringComparer.Ordinal)
                .ToList();
            var parts = new List<string>();
            foreach (var key in keys)
            {
                var value = parameters[key];
                // The null value is not involved in signing.
                if (value == null)
                {
                    continue;
                }
                // The empty string is involved in signing.
                var strValue = BuildSignData(value);
                parts.Add($"{key}={strValue}");
            }
            return string.Join("&", parts);
        }
        /// <summary>
        /// Process data of the array type.
        /// </summary>
        /// <param name="arr">Array</param>
        /// <returns>String to be signed</returns>
        private string BuildArraySignData(List<object> arr)
        {
            var parts = new List<string>();
            foreach (var item in arr)
            {
                if (item == null)
                {
                    continue;
                }
                parts.Add(BuildSignData(item));
            }
            return string.Join(",", parts);
        }
        /// <summary>
        /// Convert Base64 to Hex.
        /// </summary>
        /// <param name="base64String">Base64 string</param>
        /// <returns>Hexadecimal string</returns>
        private string Base64ToHex(string base64String)
        {
            var bytes = Convert.FromBase64String(base64String);
            return BitConverter.ToString(bytes).Replace("-", "").ToLower();
        }
        /// <summary>
        /// Parse a JSON string as a dictionary.
        /// </summary>
        /// <param name="jsonStr">JSON string</param>
        /// <returns>Dictionary</returns>
        public Dictionary<string, object> ParseJSON(string jsonStr)
        {
            using var document = JsonDocument.Parse(jsonStr);
            var result = new Dictionary<string, object>();
            foreach (var element in document.RootElement.EnumerateObject())
            {
                result[element.Name] = ParseJsonElement(element.Value);
            }
            return result;
        }
        /// <summary>
        /// Parse a JSON element.
        /// </summary>
        /// <param name="element">JSON element</param>
        /// <returns>Object</returns>
        private object ParseJsonElement(JsonElement element)
        {
            switch (element.ValueKind)
            {
                case JsonValueKind.String:
                    return element.GetString();
                case JsonValueKind.Number:
                    if (element.TryGetInt32(out int intValue))
                        return intValue;
                    if (element.TryGetInt64(out long longValue))
                        return longValue;
                    return element.GetDouble();
                case JsonValueKind.True:
                    return true;
                case JsonValueKind.False:
                    return false;
                case JsonValueKind.Null:
                    return null;
                case JsonValueKind.Object:
                    var dict = new Dictionary<string, object>();
                    foreach (var prop in element.EnumerateObject())
                    {
                        dict[prop.Name] = ParseJsonElement(prop.Value);
                    }
                    return dict;
                case JsonValueKind.Array:
                    var list = new List<object>();
                    foreach (var item in element.EnumerateArray())
                    {
                        list.Add(ParseJsonElement(item));
                    }
                    return list;
                default:
                    return element.ToString();
            }
        }
        /// <summary>
        /// Generate a string to be signed from the JSON string.
        /// </summary>
        /// <param name="jsonStr">JSON string</param>
        /// <returns>String to be signed</returns>
        public string GenerateSignDataFromJSON(string jsonStr)
        {
            var parameters = ParseJSON(jsonStr);
            return GenerateSignData(parameters);
        }
    }
}
// Test.
using Xunit;
using PaySignature;
namespace PaySignatureTest
{
    public class SignatureUtilsTest2
    {
        private readonly SignatureUtils _utils;
        public SignatureUtilsTest2()
        {
            _utils = new SignatureUtils();
        }
        /// <summary>
        /// Test the construction of a to-be-signed string.
        /// </summary>
        [Fact]
        public void TestComplexNestedStructure()
        {
            var goods = new List<object>
            {
                new Dictionary<string, object>
                {
                    { "goodsId", "G001" },
                    { "goodsName", "Product 1" },
                    { "quantity", 2 }
                },
                new Dictionary<string, object>
                {
                    { "goodsId", "G002" },
                    { "goodsName", "Product 2" },
                    { "quantity", 3 }
                }
            };
            var parameters = new Dictionary<string, object>
            {
                { "appId", "5765880207854262xxx" },
                { "goods", goods },
                { "totalAmount", 100 }
            };
            var signData = _utils.GenerateSignData(parameters);
            Assert.Contains("appId=5765880207854262xxx", signData);
            Assert.Contains("goods=", signData);
            Console.WriteLine($"Sign data with complex structure: {signData}");
        }
    }
}

// Signing example
using System.Text;
using Org.BouncyCastle.OpenSsl;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.Security;
using Org.BouncyCastle.Crypto.Signers;
using Org.BouncyCastle.Crypto.Engines;
using Org.BouncyCastle.Crypto.Digests;
class SignProgram
{
    public static void Main(string[] args)
    {
        string res = RSASign("Sign the sorted and concatenated content","Private key")
        Console.WriteLine("result: " + res);
    }
    public static string RSASign(string datastr,string privateStr)
    {
        var priKey = "-----BEGIN PRIVATE KEY-----\n"+ privateStr +"\n-----END PRIVATE KEY-----\n";
        byte[] data = Encoding.UTF8.GetBytes(datastr);
        // Create a PSS signer.
        var signer = new PssSigner(new RsaEngine(), new Sha256Digest());
        AsymmetricKeyParameter rsaPrivateKey = null;
        using (var stringReader = new StringReader(priKey))
        {
            var pemReader = new PemReader(stringReader);
            rsaPrivateKey = pemReader.ReadObject() as AsymmetricKeyParameter;
        }
        signer.Init(true, new ParametersWithRandom(rsaPrivateKey, new SecureRandom()));
        signer.BlockUpdate(data, 0, data.Length);
        byte[] signature = signer.GenerateSignature();
        return Convert.ToBase64String(signature);
    }
}

Signature Verification Rules

Signature verification scenario: The merchant needs to perform signature verification on the information from the Payment Kit server to verify that the signature information comes from the Payment Kit server. The merchant server performs signature verification on the callback notification request parameters and refund notification request parameters returned by the Payment Kit server.

Signature verification algorithm: SM2

Development procedure: Confirm the public key certificate for signature verification, confirm that the fields to be signed are converted into the "key=value" format and combined &, and use the signature verification method to verify the signature.

Obtain the Huawei Pay public key. The public key certificate is the one obtained from Huawei Pay merchant platform. For details, see Downloading the Huawei Pay Certificate.
Obtain the fields involved in signing, convert them into a map, sort the key-value pairs in the map, and concatenate them using &.
Use the SM2 algorithm for signature verification. For details, see the verifySign method of the VerifyTools.java class in the Maven dependency (pay-java) provided by Huawei Pay in the sample code.

Due to business development needs, API fields may change. It is recommended that the signature verification function be implemented in an extensible manner. That is, perform signature verification on the request body of the callback notification and then convert it into a business object for processing. This ensures that signature verification can still be performed properly when fields change.

[h2]Sample Code for Signature Verification with SM2 in Common Languages

JavaScript

JavaScript implements signature verification using the sm-crypto module. If the Node .js environment has been installed, run the following command to install the sm-crypto module:

npm install sm-crypto