v2.0.0

v2.0.0

Warning

Breaking change for GMPay integrations

GMPay request and callback signatures have changed from MD5 to HMAC-SHA256.
Existing GMPay clients using MD5 will receive 401 Unauthorized and must be upgraded before deploying this release.

The EPay-compatible API is not affected and continues to use MD5 signatures.

GMPay Migration

The GMPay endpoint path remains unchanged:

POST /payments/gmpay/v1/order/create-transaction

The new signature is calculated as follows:

1. Exclude the signature field and parameters with empty values.
2. Sort parameter names in ASCII ascending order.
3. Join parameters as key=value&key=value.
4. Calculate HMAC-SHA256 using the merchant secret_key as the HMAC key.
5. Encode the result as 64-character lowercase hexadecimal text.

signature = hex_lower(
  HMAC-SHA256(
    key = secret_key,
    message = canonical_params
  )
)

GMPay callback signatures must be verified using the same HMAC-SHA256 rules.

Python SDK Example

A ready-to-use Python example is included in this release:

sdk/python/gmpay_create_order.py

It uses only Python's standard library (urllib) and does not require requests or other third-party packages.

GMPAY_SECRET_KEY='replace-with-your-secret-key' \
python3 sdk/python/gmpay_create_order.py \
  --api-url 'https://pay.example.com/payments/gmpay/v1/order/create-transaction' \
  --pid '1000' \
  --notify-url 'https://merchant.example.com/payment/notify' \
  --redirect-url 'https://merchant.example.com/payment/return' \
  --token 'usdt' \
  --network 'binance' \
  --currency 'cny' \
  --amount '1'

What's Changed

Full Changelog: v1.0.10...v2.0.0