Website Alipay/WeChat Pay Integration Guide: From Zero to Successful Payment

Website Alipay/WeChat Pay Integration Guide: From Zero to Successful Payment

For websites serving Chinese users, Alipay and WeChat Pay are essential payment methods. The overall flow is: a user places an order on the page → they are redirected to the Alipay checkout or prompted to scan a WeChat QR code → the platform sends an asynchronous notification to your server once payment completes → your backend verifies the signature and updates the order → the front end either polls or returns to the redirect URL to confirm the result. Once you understand this chain, every step that follows is just filling in parameters.

From applying for the merchant account to running the first real transaction, plan for roughly 3 working days to 2 weeks depending on your paperwork and integration speed:

1. Prerequisites

1.1 Required Qualifications

1.2 Website Requirements

• ICP filing completed
• HTTPS enabled
• Complete product/service pages
• Clear refund and after-sales policy

2. Alipay Integration

2.1 Registration

1. Log in to Alipay Open Platform
2. Create application → Web/Mobile App
3. Configure encryption (RSA2 recommended)
4. Submit for review (1-3 business days)

2.2 Initiate Payment

$aop = new AopClient();
$aop->gatewayUrl = $config['gateway_url'];
$aop->appId = $config['app_id'];
$aop->rsaPrivateKey = $config['merchant_private_key'];

$request = new AlipayTradePagePayRequest();
$request->setBizContent(json_encode([
    'out_trade_no' => 'ORDER_' . time(),
    'product_code' => 'FAST_INSTANT_TRADE_PAY',
    'total_amount' => '99.99',
    'subject' => 'Product Name',
]));
$result = $aop->pageExecute($request);

3. WeChat Pay Integration

3.1 Registration

1. Log in to WeChat Pay Merchant Platform
2. Submit business documents
3. Complete account verification
4. Obtain merchant ID

3.2 Native Payment (PC Website)

const { code_url } = await wechatPay.native({
  description: 'Product Name',
  out_trade_no: 'ORDER_' + Date.now(),
  amount: { total: 9999, currency: 'CNY' },
});
// Display QR code for user to scan

4. Payment Notification Handling

4.1 Alipay Async Notification

$aop = new AopClient();
$result = $aop->rsaCheckV1($_POST, $config['alipay_public_key'], 'RSA2');
if ($result && $_POST['trade_status'] == 'TRADE_SUCCESS') {
    updateOrderStatus($_POST['out_trade_no'], 'paid');
    echo 'success';
}

5. Fee Comparison

6. Payment State Flow and Security

Order state transitions

A typical order moves through pending payment → paid → (optionally) refunded, plus closed when it times out unpaid. The only trustworthy source for "did the user actually pay" is the server-side asynchronous notification, not the front-end callback — front-end results can be forged, while async notifications carry the platform's signature.

Two things matter most. First, verify the notification signature and re-check the amount and order number against your database. Second, make handling idempotent: the same out_trade_no can be notified multiple times, so check the order state before acting and return success for already-paid orders to avoid double shipping or double bookkeeping. Finally, use active order lookup as a backstop: if an async notification is lost in transit, poll the query API on a schedule — for example every 5 minutes up to 12 times after the order is placed.

Payment security and compliance essentials

• Always verify callbacks: validate notification parameters with the platform public key. Skipping this is equivalent to leaving your "update order status" endpoint open on the public internet.
• Re-check amounts: trust the amount stored in your own database; treat callback amounts as reference only, so a tampered notification cannot change what you charge.
• HTTPS everywhere: run payment pages and callback endpoints over HTTPS to prevent parameter interception — see the HTTPS migration guide.
• Never store secrets in code: keep the merchant private key and APIv3 key in environment variables or a secret manager, not in the repository.
• Guard against fraud and abuse: monitor abnormal patterns such as high-frequency orders from one account or rapidly changing payee details — see payment fraud prevention strategies.

7. Common Questions

Signature verification keeps failing

Check three things: whether both sides use RSA2 (not a mix of RSA2 and RSA1); whether the correct public keys are uploaded (you upload your application public key, but verify callbacks with the platform public key); and whether the server clock differs too much from real time. During integration, use a payment gateway sandbox to get the signature chain working before switching to production keys.

How to use the sandbox

Both Alipay Open Platform and WeChat Pay provide sandbox/test environments. Run the full flow there with test accounts and test keys, confirm callbacks, refunds, and reconciliation, then switch to production. Remember that sandbox and production keys, certificates, and callback URLs are typically isolated — these three are the easiest places to make a mistake during the switch.

8. Summary

Integrate both Alipay and WeChat Pay to cover 95%+ of Chinese mobile payment users. If resources are limited, consider third-party payment aggregators. Fees, settlement periods, and refund policies differ by platform — compare them in payment channel rate comparison; for multi-currency or overseas collection see cross-border collection comparison.

Reference: Alipay Open Platform docs https://opendocs.alipay.com/; WeChat Pay developer docs https://pay.weixin.qq.com/docs/developer/apis/platsolution/platsolution.html