API 文档

流程：创建账单 → 将客户引导至收款页面 → 接收签名 webhook。前缀 /v1。通过 X-Api-Key 请求头认证。

OpenAPI 3 规范 (JSON) 获取密钥

支持的网络

从其他支付平台迁移——无需重写代码

已经接入了 Cryptomus / NOWPayments / Coinbase Commerce？在 SDK 里只需换掉 base-URL 和密钥——我们接受它们的 create-invoice 格式，以它们的响应格式返回我们的支付页面，并以它们的带签名格式发送 Webhook，您现有的验签代码原样可用。通过 order_id 关联。

# 之前:  https://api.cryptomus.com/v1/payment
# 之后:  https://paygate.love/compat/cryptomus/v1/payment
# 密钥: 您的 paygate API 密钥；Webhook 密钥 = 您的 paygate apiSecret

需要接入其他处理商？联系我们——新增一个适配器只是一个模块的事。

在您自己的 Telegram 机器人内收款

您的机器人就是商家？别把用户引到网站或第三方钱包机器人。您的机器人调用我们的 API，直接在聊天中显示地址 + 金额 + 二维码，付款一经链上确认，机器人就自动把消息改为“✅ 已支付”。与 CryptoBot 相同的机器人内支付体验，但加密货币直达您的账户，密钥归您，手续费低到可以忽略。

1. POST /v1/invoices               # 您的 API 密钥 → { id, pay_address, pay_uri, amount_expected }
2. bot.sendPhoto( https://paygate.love/i/<id>/qr.png )   # 公开二维码，Telegram 会自行抓取
   + “打开钱包”按钮 → pay_uri
3. 我们的 invoice.paid Webhook → bot.editMessage →“✅ 已支付”

用户全程不离开商家的机器人。二维码接口 /i/<id>/qr.png 是公开的（仅编码地址）。可直接复制粘贴的示例（grammy/telegraf）见 docs/BOT-INTEGRATION.md.

面向主播：打赏提醒、目标进度条、排行榜

下面所有主播端点都使用提醒令牌（alert token）——它已经嵌入在后台「提醒」页面显示的悬浮层和排行榜链接中。这是一个只读权限：它不能代替你的 API 密钥，但也不要公开发布挂件链接。本质上，一笔打赏就是一张带有打赏者昵称和留言的账单。

如何在直播间接入打赏——分步指南

1. 注册为主播：在注册页面选择「主播 / 创作者」账户类型——后台会针对打赏进行定制。
2. 打开 后台 →「提醒」：这里有悬浮层链接（/alerts/widget?token=…）、提醒样式设置和目标编辑器。复制悬浮层链接。
3. 在 OBS/Streamlabs 中：来源 →「+」→ 浏览器（Browser Source） → 粘贴链接，把尺寸设为画布大小（如 1920×1080）→ 确定。打赏提醒和目标进度条即会显示在直播画面上；可用测试打赏按钮验证。
4. 在同一「提醒」页面设置募集目标——标题、目标金额和货币。进度条会出现在悬浮层中，也可通过 GET /alerts/goal 获取。
5. 创建打赏链接（后台 →「链接」），把链接/二维码分享给观众，并把公开排行榜 /d/<token> 发布到你的频道。
6. 进阶：通过 POST /v1/donations/external 推送其他平台的打赏，或用 GET /alerts/goal 给第三方进度条供数——详见下文。

OBS 悬浮层（Browser Source）

一个现成的 HTML 页面，包含实时打赏提醒和目标进度条——把它作为 Browser Source 添加到 OBS/Streamlabs：

https://paygate.love/alerts/widget?token=<alertToken>

募集目标——任何进度条都能用的 JSON（拉取）

当前目标的公开 JSON（令牌即访问凭证；缓存约 5 秒）。任何外部进度条挂件都可以轮询它，在别处显示合并后的总额——这就是把 paygate 募捐接到其他进度条的方法。

curl "https://paygate.love/alerts/goal?token=<alertToken>"
→ { "active": true, "title": "New PC", "target": 1000,
    "current": 337.5, "currency": "USD" }
# 未设置目标 → { "active": false }

外部打赏——把其他来源汇入同一条进度条（推送）

记录一笔发生在别处的打赏（PayPal、DonationAlerts、手动录入），让它计入同一条目标进度条，并可选地触发同样的 OBS 提醒。一条进度条汇总所有来源——加密货币加上你推送来的一切。鉴权：你的 API 密钥。

curl -X POST https://paygate.love/v1/donations/external \
  -H "X-Api-Key: pk_..." -H "Content-Type: application/json" \
  -d '{ "amount": 5, "currency": "USD", "name": "Alice",
        "message": "gg!", "source": "paypal", "fire_alert": true }'
→ 201 { "ok": true, "amount_usd": 5 }

字段：amount（>0，必填）、currency（默认 USD）、name（≤60）、message（≤300）、source（≤40，默认 "api"）、fire_alert（默认 true）。金额会折算成 USD 计入目标总额。

实时提醒流（SSE）

每笔打赏推送一条 Server-Sent Events——你可以抛开我们的挂件，构建完全自定义的悬浮层：

const es = new EventSource(
  "https://paygate.love/alerts/stream?token=<alertToken>");
es.onmessage = (e) => {
  const d = JSON.parse(e.data); // { name, amount, currency, asset, message }
  showAlert(d);
};

公开排行榜

一个可分享的公开打赏榜页面（打赏最多的人、最近的打赏、目标）——把它发到频道简介或聊天区：

https://paygate.love/d/<alertToken>

提现：默认打赏为托管模式——随时在后台提现。或者在后台添加你钱包的 xpub（非托管），打赏会直接进入你在 EVM / TRON / BTC / LTC / DOGE 上的钱包。

推荐计划

邀请商家和主播——他们每笔付款，您都能终身获得我们佣金的分成。默认比例为 20%，且可为每位合作伙伴单独设定。

https://paygate.love/?ref=<yourCode>

您的专属链接在 后台 → 「推荐」。任何通过该链接注册的用户（?ref= 代码通过 cookie 自动记录，也可在注册表单的选填字段中填写）将永久绑定到您名下。

被邀请商户的每笔已确认（已支付）发票都会自动计算分成，以 USD 计；统计与金额见 后台 → 「推荐」。

💸 打赏者预付钱包（即时打赏）

观众只需充值一次（crypto 仅确认一次），随后即可用内部余额向任意 Paygate 主播即时打赏——提示立刻弹出，每次打赏都无需等待网络。打赏会进入你的常规余额；照常提现即可。钱包页面：/w（持有者链接，token 放在 #fragment 中，绝不会进入日志）。

🧩 Plugin setup guides

Before you start, grab your API key and secret from your store's Settings page. ⚙️

🛒 WooCommerce — setup

1. Download the plugin zip (the “Download” button on the Plugins page or in your dashboard).
2. WP Admin → Plugins → Add New → Upload Plugin → choose the zip → Install → Activate.
3. WooCommerce → Settings → Payments → enable “Paygate (crypto)” and click Manage.
4. Paste your API key and secret, save. The webhook is wired automatically.
5. Place a test order: pick “Paygate” at checkout, pay, and the order flips to Paid on the signed webhook.

🖥️ WHMCS — setup

1. Download and unzip. Inside you'll find a modules/gateways/ folder.
2. Upload the contents of modules/gateways/ into your WHMCS root (it merges with the existing structure).
3. WHMCS Admin → Setup → Payments → Payment Gateways → “All Payment Gateways” tab → activate “Paygate”.
4. Enter your API key and secret, save. Verify with a test invoice — status updates via the callback.

🛍️ OpenCart — setup

1. Download the zip. Copy the contents of upload/ into your OpenCart root (merges with admin/ and catalog/), or install the zip via Extensions → Installer.
2. Extensions → Extensions → Payments → find “Paygate — Crypto Payments” → “+” (Install) → pencil (Edit).
3. Status = Enabled, paste your API key and secret, pick the order statuses, save. The webhook is wired automatically (callback_url).
4. Test order: pick “Pay with Crypto” at checkout, pay, and the status updates via the signed webhook.

🧿 PrestaShop — setup

1. Download the module zip. Back office → Modules → Module Manager → “Upload a module” → choose the zip → install.
2. Click “Configure”, paste your API key and secret (leave base URL as https://paygate.love), save.
3. The webhook is wired automatically (callback_url) and shown on the settings page.
4. Test order: pick “Pay with Crypto”, pay, and the order moves to “Payment accepted” on the signed webhook.

🅜 Magento 2 — setup

1. Copy the Paygate folder into app/code/ (module lives at app/code/Paygate/Crypto).
2. From the Magento root: bin/magento module:enable Paygate_Crypto && bin/magento setup:upgrade && setup:di:compile && cache:flush.
3. Admin → Stores → Configuration → Sales → Payment Methods → “Paygate — Crypto Payments”: Enabled = Yes, paste your API key and secret, save.
4. Webhook: https://your-store/paygate/webhook (sent automatically as callback_url). Verify with a test order.

🛒 CS-Cart — setup

1. Download the zip. Administration → Add-ons → Manage add-ons → “+” (Upload & install) → choose the zip.
2. Administration → Payment methods → Add: Processor = “Paygate (crypto)”.
3. On the Configure tab paste your API key and secret (leave base URL as https://paygate.love), save and activate.
4. The webhook is wired automatically (callback_url). Verify with a test order — the status updates via the signed webhook.

🅱️ Blesta — setup

1. Download the zip. Copy components/gateways/nonmerchant/paygate/ into your Blesta install at the same path.
2. Settings → Company → Payment Gateways → Available → install “Paygate — Crypto Payments”.
3. Click “Manage”, enter your API key and secret (leave base URL as https://paygate.love), save.
4. The callback URL is Blesta's standard gateway callback, sent automatically. Verify with a test invoice.

🧾 FOSSBilling — setup

1. Download the zip and extract library/Payment/Adapter/Paygate.php into your FOSSBilling root (paths merge).
2. Admin → System → Payment gateways → New payment gateway → activate “Paygate”.
3. Paste your API key and secret (leave base URL as https://paygate.love), save.
4. The webhook (IPN) is wired automatically as callback_url. Verify with a test invoice — payment applies via the signed webhook.

💬 XenForo — setup

1. Download the zip and copy the contents of upload/ into your forum root (creates src/addons/Paygate/Crypto).
2. Admin → Add-ons → install “Paygate — Crypto Payments”.
3. Admin → Setup → Payment profiles → Add payment profile → Paygate: paste your API key and secret, save.
4. Attach the profile to your User upgrades. Payment confirms via the signed webhook through payment_callback.php.

📦 BoxBilling — setup

1. Download the zip and extract bb-library/Payment/Adapter/Paygate.php into your BoxBilling root.
2. Admin → Configuration → Payment gateways → New payment gateway → activate “Paygate”.
3. Paste your API key and secret (base URL https://paygate.love), save. The webhook (IPN) wires automatically.
4. Verify with a test invoice — payment applies via the signed webhook.

🎮 Paymenter — setup

1. Download the zip and extract extensions/Gateways/Paygate into your Paymenter root.
2. Admin → Extensions → Gateways → enable “Paygate”.
3. Paste your API key and secret (base URL https://paygate.love), save.
4. Webhook: /extensions/gateways/paygate/webhook (sent automatically as callback_url). Verify with a test invoice.

👥 Invision Community — setup

1. Download the zip and install the paygate application (AdminCP → System → Applications; see README for dev-mode / tar build).
2. AdminCP → Commerce → Payments → Payment Methods → Create New → Paygate.
3. Paste your API key and secret (base URL https://paygate.love), save.
4. Payment confirms via the signed webhook; underpaid goes to Held for manual review.

📋 vBulletin — setup (vB4 / vB5)

1. Pick your archive: vB4 (4.2.x) → includes/paymentapi/class_paygate.php; vB5 → core/includes/paymentapi/class_paygate.php.
2. Copy the class file to the right path and run install.sql from the archive (registers the method in the paymentapi table).
3. AdminCP → Paid Subscriptions → Payment API Manager → Paygate: enable, paste your API key and secret (base URL https://paygate.love).
4. The subscription activates via the signed webhook (payment_gateway.php); duplicates bounce on the transaction id.

🎮 Azuriom — setup

1. Download the zip and add PaygateMethod to the Shop plugin (see README: patch PaymentManager or register via registerPaymentMethod).
2. Admin → Shop → Settings → Payment gateways → Paygate: paste your API key and secret (base URL https://paygate.love).
3. Payment confirms via the signed webhook (shop.payments.notification); completed payments are idempotent.

🏬 Webasyst / Shop-Script — setup

1. Download the zip and extract wa-plugins/payment/paygate into your Webasyst root.
2. Store → Settings → Payment → add method → Paygate: paste your API key and secret (base URL https://paygate.love).
3. Payment confirms via the signed webhook (waPayment relay URL); dedup via native_id.

🛒 X-Cart — setup

1. Download the zip and extract classes/ and skins/ into your X-Cart root, then rebuild the cache (Re-deploy).
2. Admin → Store setup → Payment methods → enable “Paygate”.
3. Paste your API key and secret (base URL https://paygate.love), save. Payment confirms via the signed webhook.

🛍️ Zen Cart — setup

1. Download the zip: module file to includes/modules/payment/, language to includes/languages/english/modules/payment/, and ipn_paygate.php to the store root.
2. Admin → Modules → Payment → Paygate → Install; paste your API key and secret (base URL https://paygate.love).
3. The order is created as pending; status updates via the signed webhook (ipn_paygate.php).

🏪 osCommerce — setup

1. Download the zip (targets osCommerce 2.3.x): module file to includes/modules/payment/, callback.php to ext/modules/payment/paygate/, language to includes/languages/english/….
2. Admin → Modules → Payment → Paygate → Install; paste your API key and secret (base URL https://paygate.love).
3. Order status updates via the signed webhook (ext/…/callback.php); the webhook retries until the order is found.

🛒 VirtueMart (Joomla) — setup

1. Joomla → Extensions → Install: upload the zip (or copy to plugins/vmpayment/paygate/ and click Discover).
2. Enable the “VM Payment - Paygate” plugin, then VirtueMart → Payment Methods → create a method using it.
3. Paste your API key and secret (base URL https://paygate.love), save. Payment confirms via the signed webhook.

💧 Drupal Commerce — setup

1. Extract the module to modules/custom/paygate (or via composer), enable it on Extend.
2. Commerce → Configuration → Payment gateways → Add: choose Paygate (off-site redirect).
3. Paste your API key and secret (base URL https://paygate.love), save. The notify webhook is the source of truth.

⬇️ Easy Digital Downloads — setup

1. WP Admin → Plugins → Add New → Upload → choose the zip → Install → Activate.
2. Downloads → Settings → Payment Gateways → enable “Paygate” and open its settings.
3. Paste your API key and secret (base URL https://paygate.love), save. Payment confirms via the signed webhook (edd-listener).

🧾 HostBill — setup (free bridge)

1. This is a lightweight bridge, not the paid SDK module: unzip it into a web-accessible folder, e.g. https://your-billing/paygate/.
2. HostBill → Settings → API: create an API user, whitelist this server's IP. Copy config.sample.php → config.php and fill in the HostBill + Paygate keys and a random link_secret.
3. In your Paygate store settings set the webhook/callback → https://your-billing/paygate/callback.php. A payment closes the invoice automatically via the Admin API (addInvoicePayment).
4. Add the “Pay with Crypto” button to invoices via the hooks/paygate_button.php hook (into includes/hooks/) or a ready signed link pay.php?invoice_id=…&token=… — see the README.

🖥️ WISECP — setup

1. Copy the coremio/ folder from the zip over your WISECP root (the module lands in coremio/modules/Payment/Paygate/).
2. Admin → Settings → Payment Gateways → enable “Paygate — Crypto Payments” and paste your API key and secret (base URL https://paygate.love).
3. No webhook setup needed: the module passes its callback link with every checkout. Payment confirms via the signed webhook.

🧾 ClientExec — setup

1. Unzip the archive into plugins/gateways/paygate/ of your ClientExec install.
2. Settings → Plugins → Payment Processors → activate Paygate and paste your API key and secret (base URL https://paygate.love).
3. Webhook: https://your-domain/plugins/gateways/paygate/callback.php — set it in your Paygate store settings.

🎨 Tilda — setup (universal payment system)

1. This is a self-hosted bridge: unzip it onto your PHP hosting (e.g. https://your-domain/paygate/) and fill in config.php from the sample.
2. In Tilda: Site Settings → Payment Systems → Universal payment system → API URL = https://your-domain/paygate/receive.php; field mapping and signature per the README.
3. Paygate webhook: https://your-domain/paygate/callback.php. On payment the bridge sends Tilda a signed notification — the order flips to paid.

🛒 BigCommerce — setup (bridge)

1. BigCommerce's native payment list is partner-gated, so this is a bridge: unzip onto your PHP hosting and fill in config.php.
2. In BigCommerce create a store-level API account (Orders scope), enable the offline method “Cryptocurrency (Paygate)” and add the pay button per the README (Script Manager).
3. Paygate webhook: https://your-domain/paygate/callback.php — on payment the order moves to Awaiting Fulfillment automatically.

🛍️ Zid — setup (private bridge)

1. Zid's App Store won't list crypto (SAMA), so the bridge runs privately with your own partner credentials. Deploy the Node service from the zip (npm i && npm run build).
2. Fill in .env (Zid tokens, Paygate keys) and register the order-created webhook per the README.
3. The buyer pays via the /pay/:orderId link; on confirmation the bridge marks the order paid through the Zid API.

1. 创建账单

POST /v1/invoices
X-Api-Key: pk_...
Idempotency-Key: order-1042        # 选填，防止重复
Content-Type: application/json

{ "network": "ton", "asset": "USDT", "amount": "25.00", "order_id": "1042" }

响应中包含 id、pay_address、pay_uri、expires_at。将买家引导至 /pay/。

可选请求字段：quote_currency（金额币种，默认 USD）、order_id、callback_url（针对单个账单的 webhook）、success_url（支付后买家的返回地址）、test（沙盒）。完整响应还包含 status、network、asset、amount_expected、rate_locked、fee_percent、telegram_url。

沙盒：添加 "test": true —— 该账单不会被链上监控，也不影响您的余额；可在控制台模拟其支付以验证 webhook。其 webhook 签名方式相同，但会携带 "test": true —— 仅当 test === false 时才发货。

1b. Live rate — price a USD amount in BTC/LTC

GET /v1/quote?asset=BTC&quote_currency=USD
X-Api-Key: pk_...
→ { "asset": "BTC", "quote_currency": "USD", "rate": "63022.25" }

# price a $12.99 item in BTC:
#   amount = 12.99 / 63022.25 = 0.00020612  → send as "amount" to /v1/invoices
# optional: pass &amount=12.99 to get "quote_amount" back too

The amount is denominated in quote_currency (default USD) — the gateway converts it to the coin at the live rate, no manual math needed. For USDT/USDC quoted in USD that's 1:1. To price directly in the coin, set quote_currency to the coin symbol (e.g. quote_currency=BTC) — then no conversion happens. The rate comes from CoinGecko/Coinbase, refreshes every ~45s and is locked into the invoice (rate_locked), so the buyer always pays the correct up-to-the-minute amount. The response returns quote_amount (as you sent it) and amount_expected (the final coin amount).

Don't want to do the math? Use POST /v1/checkouts with a USD amount — the buyer picks the coin and we handle the live conversion.

支付链接（由买家选择币种）

POST /v1/checkouts
X-Api-Key: pk_...
Content-Type: application/json

{ "amount": "25.00", "quote_currency": "USD", "order_id": "1042" }
→ { "checkout_url": "https://…/checkout/…", "short_url": "https://…/c/…",
    "telegram_url": "https://t.me/…", "expires_at": "…" }

POST /v1/checkouts 附带金额即可创建一个链接，由买家自行选择网络和币种——无需任何集成，最为方便。响应包含：checkout_url、short_url、telegram_url、expires_at。支持与账单相同的 order_id、callback_url 和 success_url。

🤖 在 Telegram 机器人 / 商店中收款

直接在 Telegram 里卖货？无需自己的网站。您的机器人通过 API 创建收款单并获得 telegram_url —— 一个 deep link，直接在我们的 Telegram 机器人内打开支付流程：买家选择币种/网络，看到地址和 QR 码后付款。您收到带签名的 webhook 并交付商品。

1. 买家在您的机器人里点击“购买”→ 您的机器人调用 POST /v1/checkouts（附带 order_id 和 callback_url）。
2. 您的机器人回复一个内联按钮，链接指向 telegram_url（或使用 short_url 在网页上支付）。
3. 买家无需离开 Telegram 即可完成支付 → 您收到 invoice.paid webhook → 机器人交付商品/权限。

// Telegram bot (grammY/Telegraf) — sell for crypto
bot.callbackQuery("buy", async (ctx) => {
  const r = await fetch("https://paygate.love/v1/checkouts", {
    method: "POST",
    headers: { "X-Api-Key": PK, "Content-Type": "application/json" },
    body: JSON.stringify({ amount: "9.99", quote_currency: "USD",
      order_id: ctx.from.id + ":" + Date.now(),
      callback_url: "https://my-bot.example/paygate-webhook" }),
  }).then((x) => x.json());
  // r.telegram_url opens the pay flow INSIDE Telegram (coin choice + address + QR)
  await ctx.reply("Оплатить криптой:", {
    reply_markup: { inline_keyboard: [[{ text: "💳 Pay", url: r.telegram_url }]] },
  });
});

// Deliver the goods on the signed webhook (see "Webhooks" below)
app.post("/paygate-webhook", (req, res) => {
  if (verifySignature(req) && req.body.event === "invoice.paid" && !req.body.test)
    deliverOrder(req.body.order_id);   // ship / grant access
  res.sendStatus(200);
});

提示：使用 telegram_url 在 Telegram 内支付，若想要普通的网页收银台页面则使用 short_url。请将 order_id 与买家（chat id）和订单绑定，以便 webhook 能唯一匹配。在 test 不为 false 时切勿发货。

2. 账单状态

GET /v1/invoices/<id>
X-Api-Key: pk_...
→ { "status": "paid", "amount_received": "25",
    "settlement": { "gross": "25", "fee": "…", "spread": "…", "net": "…", "revenue": "…" } }

状态：pending → detected → paid（另有 underpaid、overpaid、expired、cancelled、settled）。

更多接口

GET /v1/invoices — 分页列出账单（limit 最大 200，offset，按 status 筛选）。
POST /v1/invoices/<id>/cancel — 取消 pending/detected 状态的账单（触发 invoice.cancelled）。
GET /v1/quote?asset=&quote_currency=&amount= — 预览汇率和折算后的金额。
GET /v1/networks — 列出网络和币种（无需密钥）。
GET /v1/reconciliation?from=&to= — 已开票与已收款的对账（限 30 次请求/分钟）。

对账：GET /v1/reconciliation?from=&to= —— 已开票金额与实收金额（扣除手续费）对比 + 逐笔订单差异（少付/多付/未付）。到账情况以我们为准；非托管模式请与您自己的钱包核对。该工具只提供数据 —— 决策（发货、争议处理）由您负责。

3. Webhook

状态变更时，我们会向您的 webhook URL 发送 POST 请求。请求头 X-Signature = HMAC-SHA256(body, api_secret)。处理前请先校验签名和时效性（timestamp）。

Webhook 载荷

{
  "event": "invoice.paid",
  "invoice_id": "inv_…", "order_id": "1042",
  "status": "paid", "test": false,
  "asset": "USDT", "network": "ton",
  "quote_currency": "USD",
  "amount_expected": "25", "amount_received": "25",
  "tx_hash": "…", "timestamp": "2026-07-12T20:00:00.000Z",
  "invoice": { "id": "inv_…", "order_id": "1042", "status": "paid",
               "quote_currency": "USD",
               "amount_expected": "25", "amount_received": "25" }
}

事件：invoice.detected、invoice.paid、invoice.underpaid、invoice.overpaid、invoice.expired、invoice.cancelled。请求头：X-Signature、X-Webhook-Id、X-Event。

// Node — verify signature (constant-time), dedupe, gate on test
import crypto from "node:crypto";
const expected = crypto.createHmac("sha256", API_SECRET).update(rawBody).digest("hex");
const sig = String(req.headers["x-signature"] ?? "");
if (sig.length !== expected.length ||
    !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)))
  return res.sendStatus(401);
const evt = JSON.parse(rawBody);
if (Date.now() - new Date(evt.timestamp) > 5*60_000) return res.sendStatus(400); // anti-replay
if (seen(req.headers["x-webhook-id"])) return res.sendStatus(200);               // idempotency
if (evt.event === "invoice.paid" && evt.test === false) fulfil(evt.order_id);   // only real payments

投递机制：先进行 3 次快速尝试，之后进入持久化队列，最多重试 12 次，退避间隔最长 1 小时。请按 X-Webhook-Id 去重。webhook URL 必须是公网可访问的 http(s) 地址——localhost/内网地址及重定向会被拒绝。在 test 不为 false 之前，切勿发货。

安全加固

• 创建账单时使用 Idempotency-Key —— 重试不会产生重复账单。
• 速率限制：每个 IP 地址每分钟 120 次请求。
• Webhook：X-Signature (HMAC)、X-Webhook-Id（幂等）、timestamp（防重放）。