SDK 包名：com.scott.payment.sdk
SDK 配置文件：merchant-config.properties
SDK 示例商户号：2606177036
SDK 示例环境：livemode=false
SDK 仓库：
 Java:https://github.com/wikerx/payment-gateway-java-sdk.git
 PHP：https://github.com/wikerx/payment-gateway-php-sdk.git
 Go：https://github.com/wikerx/payment-gateway-go-sdk.git

{header}.{payload}.{signature}

1. 从 Authorization 中提取 JWT
2. 校验 JWT 是否为 header.payload.signature 三段式结构
3. Base64URL 解码 Header，并校验 typ、alg
4. Base64URL 解码 Payload，并校验 iss、aud、merchantId、livemode、iat、exp、jti
5. 根据 merchantId 查询商户 API 私钥
6. 使用商户 API 私钥原文重新计算签名
7. 比较平台计算出的 signature 与 JWT 第三段 signature 是否一致
8. 如果一致，则验签通过；如果不一致，则拒绝请求

expectedSignature = base64Url(
  HMAC-SHA256(
    base64Url(headerJson) + "." + base64Url(payloadJson),
    apiPrivateKey
  )
)

src/test/java/com/scott/payment/sdk/jwt/OpenApiSignatureReferenceTest.java

RSA-OAEP-256 + A256GCM

protectedHeader.encryptedAesKey.iv.cipherText.tag

base64url(header).base64url(encryptedAesKey).base64url(iv).base64url(cipherText).base64url(tag)

{
  "typ": "PAYMENT-PAYLOAD",
  "alg": "RSA-OAEP-256",
  "enc": "A256GCM"
}

eyJ0eXAiOiJQQVlNRU5ULVBBWUxPQUQiLCJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0

1. 随机生成 32 字节 AES Key
2. 使用接收方公钥通过 RSA-OAEP-256 加密 AES Key
3. 对 RSA 加密结果进行 Base64URL 编码

随机生成 12 字节 IV

cipherText, tag = AES-256-GCM-Encrypt(
  plainJson,
  aesKey,
  iv,
  aad = protectedHeader
)

        OpenApiClientConfig config = OpenApiTestSupport.clientConfig();
        OpenApiPayloadCrypto crypto = new OpenApiPayloadCrypto();
        PaymentCreateRequest plainRequest = paymentCreateRequest();
        String plainJson = JsonSupport.toJson(plainRequest);

        OpenApiPayloadParts requestParts = crypto.encryptToParts(
                plainJson,
                RsaKeyUtils.readPublicKey(config.getPlatformPublicKey()));
        OpenApiEncryptedRequest encryptedRequest = OpenApiEncryptedRequest.builder()
                .livemode(config.getLivemode())
                .data(requestParts.toCompactPayload())
                .build();
        OpenApiPayloadParts splitParts = crypto.splitCompactPayload(encryptedRequest.getData());

        log.info("商户参考用例-请求原始明文报文: {}", JsonSupport.toLogJson(OpenApiLogSanitizer.sanitizeObject(plainRequest)));
        log.info("商户参考用例-请求密文参数: {}", JsonSupport.toLogJson(encryptedRequest));
        log.info("商户参考用例-请求参数拆分: {}", JsonSupport.toLogJson(splitParts));
        
        String encryptedAesKey = requestParts.getEncryptedAesKey();
        String iv = requestParts.getIv();
        String cipherText = requestParts.getCipherText();
        String tag = requestParts.getTag();
        log.info("encryptedAesKey：{}" , encryptedAesKey);
        log.info("iv：{}" , iv);
        log.info("cipherText：{}" , cipherText);
        log.info("tag：{}" , tag);
    }

    private PaymentCreateRequest paymentCreateRequest() {
        Map<String, Object> card = new LinkedHashMap<String, Object>();
        card.put("number", "4242424242424242");
        card.put("expMonth", "06");
        card.put("expYear", "2026");
        card.put("cvc", "123");

        PaymentCreateRequest request = new PaymentCreateRequest();
        request.setOrderNo("ORDER-PAYLOAD-PARTS");
        request.setCurrency("USD");
        request.setAmount(OpenApiTestSupport.amount("12.34"));
        request.setClientIp("47.125.221.223");
        request.setWebsite("https://manage.forgottenthrone.com/");
        request.setPaymentMethod("CARD");
        request.setPaymentMethodData(card);
        return request;
    }

src/test/java/com/scott/payment/sdk/jwt/OpenApiSignatureReferenceTest.java
测试方法：shouldBuildPostRequestHeadersAndEncryptedBodyForApifox

src/test/java/com/scott/payment/sdk/jwt/OpenApiSignatureReferenceTest.java
测试方法：shouldBuildGetRequestHeadersWithoutBodyForApifox

{
  "msg": "",
  "code": 0,
  "livemode": false,
  "data": "{compactPayload}"
}

src/test/java/com/scott/payment/sdk/crypto/OpenApiPayloadCryptoReferenceTest.java
测试方法：shouldDecryptEncryptedResponseWithSdkMethod

src/test/java/com/scott/payment/sdk/crypto/OpenApiPayloadCryptoReferenceTest.java
测试方法：shouldSplitCompactPayloadWithSdkMethod

{
  "livemode": false,
  "data": "eyJ0eXAiOiJQQVlNRU5ULVBBWUxPQUQiLCJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.{encryptedAesKey}.{iv}.{cipherText}.{tag}"
}

{
  "orderNo": "ORDER-APIFOX-SIGNATURE",
  "currency": "USD",
  "amount": 12.34,
  "clientIp": "47.125.221.223",
  "website": "https://manage.forgottenthrone.com/",
  "paymentMethod": "CARD",
  "paymentMethodData": {
    "number": "4242424242424242",
    "expMonth": "06",
    "expYear": "2026",
    "cvc": "123"
  }
}

src/test/java/com/scott/payment/sdk/client/FundAccountsBalanceInquiryTest.java