2026/05/08
Integration process
Environment Setup
- Activate Merchant Account and Obtain API Keys
- Complete merchant account setup and configuration in the operations/management backend.
- Generate the following authentication information in the backend:
AppId: Merchant Application IDAppSecret: Merchant Application Secret (Server-side only, must not be disclosed)ApiKey: Used for basic authentication and access control
- Configure IP whitelist (Recommended to only allow merchant server egress IP).
- Select Environment and Complete Connectivity Test
- Use the development environment for integration testing and verification.
- After successful testing, switch to the production environment.
- Integrate Core APIs
- Order Management: Create Order, Query Order, Query Reconciliation Statement.
- Refund Management: Create Refund, Query Refund.
- Payout Management: Create Payout, Query Payout.
- Integrate Callback Notifications (Webhook)
- Configure Order/Refund/Payout Status Notification URL in the merchant backend.
- Implement the notification processing interface, supporting:
- Verify Signature (Required)
- Idempotent Processing (Required)
- Retry Reception
- Integration Testing and Go-Live
- Perform integration testing according to business scenarios (e.g., placing an order, successful payment, timeout cancellation, successful/failed refund).
- After small-scale verification in the production environment, gradually increase traffic.
Basic Environment
- Base URL
- Development environment: https://gw.uat.rdezlink.tech
- Production environment: https://gw.rd.group
- Protocol and format
- Protocol: HTTPS
- Data format: JSON
- Character encoding: UTF-8
- API version: v1 (reflected in the URL as
/api/v1/...)
- Standard for amount fields (important)
- All fields related to amounts, fees, balances, etc. must be transmitted as strings in JSON to avoid precision loss.
- For example:
"amount": "100.00" - Do not use
"amount": 100.00
Authentication Security
Authentication Method and Signature Mechanism (Mandatory): All API requests must be made via HTTPS and include the following fields in the header for authentication and tamper-proof verification: Request Header Fields:
Signature algorithm description (recommended implementation):
- Concatenate the following items in order into a string
signPayload:- HTTP method (uppercase, e.g.,
POST) - Request path (without domain, e.g.,
/api/v1/order/create) X-App-IdX-TimestampX-Nonce- Request body raw JSON string (remove extra spaces, keep it exactly as actually sent)
- HTTP method (uppercase, e.g.,
- Use
AppSecretas the key to perform HMAC-SHA256 onsignPayload; output the result as hexadecimal or Base64, which becomesX-Signature. - The platform server will verify the signature using the same rules:
X-Timestamp is within the allowed time window (for example ±5 minutes).
Verify X-Nonce has not been reused (platform stores nonces for deduplication to prevent replay attacks).
Verify X-Signature is correct.
Example pseudocode (for illustration only):
IP Whitelist
Supports IP whitelist configuration in the following formats (set in the merchant management backend):- Single IP:
192.168.1.100 - Multiple IPs:
192.168.1.100,192.168.1.110,192.168.1.120
- Only allow access from the merchant server’s egress IP to prevent exposing the API Key to the frontend or uncontrolled environments.
- Avoid directly calling interfaces in environments such as browsers and mobile devices.
code:response code, 0000 indicates success, non-0000 indicates failure.msg: Response message with a brief error reason.data: The content of the business data.traceId: Request a trace ID for easy troubleshooting (please provide this when troubleshooting with the platform).
Order Management
Create Order
Create a new billing order and generate a payment address and checkout URL.- URL:
POST /api/v1/order/create - Content-Type:
application/json
userInfo Field Description:
productInfo Field Description:
Request Example
receiveAddress Field Description:
Multi-chain Payment Instructions:Response Example
- The system supports returning multiple receiving addresses (for different chains/currencies).
- It is recommended that the merchant’s front end, when displaying at the checkout, guide users to select only one chain to complete the payment, avoiding splitting it into multiple transactions.
- By default, the system accumulates the received amounts on an order basis. When the cumulative amount of multiple valid receipts under the same order reaches or exceeds the expected amount, the payment can be considered successful. For other strategies, please confirm with the platform.
Query Order
Query order details based on the system order ID.- URL:
POST /api/v1/order/query - Content-Type:
application/json
Request Example
Order Status Description
Response Example
Query Statement
Query order reconciliation information by paging according to the order placement time range.- URL:
POST /api/v1/order/queryRecon - Content-Type:
application/json
Request Example
Statement detail fields
Fee Details Fields
Response Example
Refund Management
Create Refund
Create a refund request for a specified order, only supporting full refunds now (partial refunds will be supported later. Actual capabilities are subject to platform configuration). To prevent fund theft, refunds will be returned to the original payment method.
- URL:
POST /api/v1/refund/create - Content-Type:
application/json
Request Example
Response Example
Query Refund
Query refund information by Refund ID or Order ID.- URL:
POST /api/v1/refund/query - Content-Type:
application/json
refundId or orderId must be provided, and only one can be provided.
Request Example
Refund Status Description
Response Example
Payout Management
Create Payout
Initiate a merchant fund settlement to the RD Convert wallet.- URL:
POST /api/v1/payout/create - Content-Type:
application/json
Request Example
Response Example
Query Payout
Query payout information by Payout ID or merchant business order number.- URL:
POST /api/v1/payout/query - Content-Type:
application/json
payoutId or merchantOrderNo must be provided.
Request Example
Payout Status Description
Response Example
Status Notification (Webhook, with Signature)
Overview When the order, refund, or payout status changes, the system sends a status notification to the notification URL configured by the merchant through an HTTPS POST request, and the signature generation and basic legitimacy verification of the callback request are handled by the gateway. Merchants need to configure the URL for receiving notifications in the management backend, only support the HTTPS protocol, and implement processing logic on the server side. All notification requests will carry a signature header and merchants must complete signature verification before proceeding with the transaction. Notification Request Headers Similar to business requests, callback notifications will also carry the following Headers:
The signature for callback requests is uniformly generated by the gateway. The signature algorithm is identical to the business request signature algorithm described in Section 3.1. The fixed concatenation rule for the signature payload is as follows:
POST + full callback URL path + X-App-Id + X-Timestamp + X-Nonce + original JSON string of the callback body
The signature algorithm is the same as in Section 3.1, and the body contains the JSON content of the notification. The merchant side must use its own stored AppSecret to verify the signature of the notification and reject requests that fail verification, returning a 401 status code.
Note: The difference here is that the full callback URL path is used, i.e., the complete URL for receiving notifications.Trigger Scenarios
Order Status Notification
- Request Method:
- URL: Notification URL configured by the merchant
- Method:
POST - Content-Type:
application/json
Request Example
Refund Status Notification
Request Parameters (Refund Notification):
Request Example
Payout Status Notification
Request Parameters (Payout Notification):
Request Example
- The merchant service must return an HTTP
200status code to indicate successful receipt and processing of the notification. - A non-
200status code or timeout will be considered a failure, and the system will retry a certain number of times (the specific strategy is subject to the platform’s actual configuration). - It is recommended to return a unified response format:
Important Requirements:
- The notification processing logic on the merchant side must implement idempotency (for example, deduplication through
orderId/refundId+ status) to avoid duplicate processing of business operations caused by repeated notifications.- Before business processing, signature verification and parameter verification must be performed first, and all requests that fail verification should be rejected.
Best Practice Recommendations
- Idempotency Control
- Use
bizNoto ensure idempotency for order creation: Requests with the samebizNowill return the same order information. - It is recommended to use UUID or a business-unique identifier as
bizNo.
- Use
- Order Status Polling
- The “Query Order” interface can be polled from the frontend or merchant system based on business needs. Set reasonable polling intervals and maximum polling durations to avoid overly frequent requests.
- Callback Notification Handling
- Upon receiving order/refund status notifications, first perform signature verification and parameter validation before proceeding with business processing.
- Implement idempotent logic to ensure that multiple notifications do not result in duplicate deductions or duplicate shipments.
- Error Handling and Troubleshooting
- Determine request success based on the
codefield. In case of failure, troubleshoot usingmsgprompts and business logs. - When troubleshooting with the platform, provide the corresponding
traceId, request time range, and key business information (e.g.,orderId/bizNo).
- Determine request success based on the
- Security Recommendations
ApiKey/AppSecretshould only be used on the server side and not exposed in frontend, mobile, or browser environments.- Configure IP whitelists to restrict access to trusted servers only.
- Use HTTPS throughout to avoid plaintext transmission.
- Regularly rotate keys and promptly update them in server configurations.
Frequently Asked Questions (FAQ) Examples
Q: What should I do if I receive a1010 authentication failure message when creating an order?
Please check:
- Whether the request carries the correct
X-Api-KeyandX-App-Idin the Header; - Whether
X-Timestampis within the allowed time window (not expired); - Whether
X-Nonceis different for each request; - Whether the signature
X-Signatureis generated according to the documentation requirements; - Whether the API Key has been enabled in the backend and is not expired;
- Whether the current request IP is within the configured whitelist range.
- Confirm that the notification URL has been correctly configured in the merchant backend;
- Check whether the merchant service can be accessed from the public network and is not blocked by a firewall;
- Review server logs to confirm whether any requests arrived but returned non-200 status codes or timed out;
- Confirm whether signature verification has been correctly handled (platforms that fail verification will log failures, which can be cross-checked with the platform using
traceId); - Compare status updates using the order/refund query interface.
- Before processing, first check based on
orderId/refundId+ status whether this status has already been processed; if so, return success directly to maintain idempotency.
- It is recommended that the frontend only display and guide users to select one chain to complete payment. If supporting multiple cumulative payments is necessary:
- Confirm with the platform whether amount accumulation across multiple chains/transactions on an order basis is allowed;
- If allowed, establish business rules to consider the order successful once the cumulative amount reaches the expected total, and include transaction details in statements.

