1. Endpoints#

2. Signature#

Sort parameters by key in alphabetical order, exclude empty values and sign, URL-encode each value (space encoded as %20), append &key=<secret_key> at the end, then take the lowercase MD5 of the whole string. Amounts always use two decimal places (e.g. 1000.00).

⚠️ Most common signature failure: spaces encoded as +. There are two kinds of URL-encoding: form encoding (PHP urlencode() / online "URL encode" tools) turns a space into +; our signature uses RFC 3986 (PHP rawurlencode() / JS encodeURIComponent() / Java URLEncoder.encode(...).replace("+","%20")), where a space is %20.
Example: any value containing a space (such as the English name John Smith) must be encoded as John%20Smith when signing, not John+Smith.

Example

Params: cus_code=MCH001, cus_order_sn=T20260921001, payment_flag=bank_twd, amount=1000.00
String to sign:
amount=1000.00&cus_code=MCH001&cus_order_sn=T20260921001&payment_flag=bank_twd&key=YOUR_SECRET_KEY
sign = md5(string above), lowercase

3. Pay-in Order /api/payment/deposit#

Request Example

Send as POST with Content-Type: application/x-www-form-urlencoded. The secret key in this example is assumed to be abc123 (replace with yours); you can use it to check your own signing code.

curl -X POST https://api.aplusmall.cash/api/payment/deposit \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "cus_code=MCH001" \
  --data-urlencode "cus_order_sn=T20261109001" \
  --data-urlencode "payment_flag=bank_twd" \
  --data-urlencode "amount=1000.00" \
  --data-urlencode "notify_url=https://www.example.com/notify" \
  --data-urlencode "payer_name=1234567834037" \
  --data-urlencode "sign=ba8f5d009f061167522e52f54a73a812"

String to sign:
amount=1000.00&cus_code=MCH001&cus_order_sn=T20261109001&notify_url=https%3A%2F%2Fwww.example.com%2Fnotify&payer_name=1234567834037&payment_flag=bank_twd&key=abc123
sign = md5(string above) = ba8f5d009f061167522e52f54a73a812

Response

{
  "result": 1, "status": "200", "message": "Success",
  "order_info": {
    "order_sn": "A...",                 // our order number
    "cus_order_sn": "T20260921001",
    "currency_type": "TWD",
    "order_amount": "1000.00",
    "payment_uri": "https://cashier.aplusmall.cash/pay/xxxx",  // cashier page, give to the payer
    "order_status": "pending",
    "expired_at": "...", "created_at": "...",
    "payment_detail": {                 // receiving account: show it to the payer
      "bank_name": "388 全盈支付",      // receiving bank (bank code + name)
      "account_no": "1150000000421"     // receiving bank account number
    }
  }
}

⚠️ Bank name and account number are not request parameters. They are the receiving account we return to you, in order_info.payment_detail of the response. It is normally included as soon as the order is created; show it to the payer, or simply redirect the payer to payment_uri (our cashier page). If the response has no payment_detail, get it via "5. Query" (same fields). The account holder name is not provided.

4. Payout Order /api/charge/receive#

Request Example

Sent the same way as pay-in (POST form). The secret key is again assumed to be abc123. Note that bank_code contains a space, which must be encoded as %20 when signing.

curl -X POST https://api.aplusmall.cash/api/charge/receive \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "cus_code=MCH001" \
  --data-urlencode "cus_order_sn=W20261109001" \
  --data-urlencode "payment_flag=pay_bank_twd" \
  --data-urlencode "amount=5000.00" \
  --data-urlencode "bank_account=0123456789012" \
  --data-urlencode "bank_code=822 中國信託" \
  --data-urlencode "notify_url=https://www.example.com/notify" \
  --data-urlencode "sign=47838ad9b37b4b5a707277d37026b61f"

String to sign:
amount=5000.00&bank_account=0123456789012&bank_code=822%20%E4%B8%AD%E5%9C%8B%E4%BF%A1%E8%A8%97&cus_code=MCH001&cus_order_sn=W20261109001&notify_url=https%3A%2F%2Fwww.example.com%2Fnotify&payment_flag=pay_bank_twd&key=abc123
sign = md5(string above) = 47838ad9b37b4b5a707277d37026b61f

Response

result: 1 means the order has been created and the payout amount has been frozen from your payout balance; the status is pending (processing). The payout result is given by the async callback or the payout query.

{
  "result": 1, "status": "200", "message": "Success",
  "order_info": {
    "order_sn": "AP20261109121044P3HV8N2D",  // our order number
    "cus_order_sn": "W20261109001",          // your order number
    "payment_flag": "pay_bank_twd",
    "currency_type": "TWD",
    "original_amount": "5000.00",
    "order_amount": "5000.00",
    "fee_amount": "50.000",                  // fee (number of decimals varies; treat as a number)
    "order_status": "pending",               // processing
    "created_at": "2026-11-09T12:10:44.123"  // Taiwan time (UTC+8)
  }
}

Failure response examples

// Insufficient payout balance (no order created, nothing frozen)
{ "result": "error", "status": 410, "message": "Insufficient withdrawal balance (available=3000.00, required=5050.00)" }

// Duplicate order number
{ "result": "error", "status": 406, "message": "Order already exists" }

On failure no order is created and no balance is frozen. required = order amount + fee. See 9. Error Codes for other codes.

5. Query#

All three query endpoints accept POST form or GET. The signature rule is the same as for order submission (every parameter you send is included in the signature).

Request example: pay-in query

The secret key is again assumed to be abc123.

curl -X POST https://api.aplusmall.cash/api/payment/info \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "cus_code=MCH001" \
  --data-urlencode "order_sn=AP20261109120530K7Q2M9XA" \
  --data-urlencode "sign=dca754ce3bd1d19de051d781f71b66e6"

String to sign:
cus_code=MCH001&order_sn=AP20261109120530K7Q2M9XA&key=abc123
sign = md5(string above) = dca754ce3bd1d19de051d781f71b66e6

Request example: payout query (by your order number)

curl -X POST https://api.aplusmall.cash/api/charge/info \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "cus_code=MCH001" \
  --data-urlencode "order_sn=W20261109001" \
  --data-urlencode "sign=1a3982df922ef5bcf2a577fc84c9a53d"

String to sign:
cus_code=MCH001&order_sn=W20261109001&key=abc123
sign = md5(string above) = 1a3982df922ef5bcf2a577fc84c9a53d

Request example: balance query

Generate ut from the current time and re-sign on every request — the 1794283200 below is only for checking your signature code; sending it as-is will be rejected as expired.

curl -X POST https://api.aplusmall.cash/api/inquire/account/info \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "cus_code=MCH001" \
  --data-urlencode "ut=1794283200" \
  --data-urlencode "sign=39b6f07ef5dd0ed67c779bb153f5b5fe"

String to sign:
cus_code=MCH001&ut=1794283200&key=abc123
sign = md5(string above) = 39b6f07ef5dd0ed67c779bb153f5b5fe

Pay-in query response (with receiving account)

{
  "result": 1, "status": "200",
  "order_info": {
    "order_sn": "A...", "cus_order_sn": "T...",
    "order_amount": "1000.00", "receive_amount": "1000.00",
    "order_status": "pending",                 // pending / success / cancel / fail (voided)
    "payment_uri": "https://cashier.aplusmall.cash/pay/xxxx",
    "payment_img": "https://.../qr.png",       // receiving QR (show if present)
    "payment_detail": {                          // receiving account (same as the submit response)
      "bank_name": "388 全盈支付",               // receiving bank (bank code + name)
      "account_no": "1150000000421"             // receiving bank account number
    }
  }
}

⚠️ If the submit response has no receiving account — poll the query endpoint

1. The receiving account is normally returned in payment_detail of the submit response; if you have it, no polling is needed.
2. If the submit response has no payment_detail, call /api/payment/info every 2–3 seconds until payment_detail (or payment_img) is returned.
3. Show the receiving account to the payer, or simply redirect to payment_uri (our cashier page shows it automatically once matched).
4. When polling returns order_status = success, the payment has arrived (the async callback is authoritative); stop polling.

Amount fields in query responses do not have a fixed number of decimal places (e.g. the fee may be 41.750); compare them as numbers, not strings. Query responses are not signed; use the async callback for amount reconciliation.

Payout query response

{
  "result": 1, "status": "200", "message": "",
  "order_info": {
    "order_sn": "AP20261109121044P3HV8N2D",  // our order number
    "cus_order_sn": "W20261109001",          // your order number
    "payment_flag": "pay_bank_twd",
    "currency_type": "TWD",
    "original_amount": "5000.00",
    "order_amount": "5000.00",
    "fee_amount": "50.000",                  // fee
    "order_status": "success",               // pending / success (paid out) / cancel / fail (voided)
    "created_at": "2026-11-09T12:10:44.123"  // Taiwan time (UTC+8)
  }
}

Balance query response

{
  "result": 1, "status": "200", "message": "Success",
  "account_info": {
    "nickname": "MCH001", "email": "...", "contact_person": "...", "contact_phone": "...", "company": "...",
    "created_at": "2026-10-01T10:00:00",
    "total_deposit": "125000.000",   // pay-in available balance
    "total_deduct": "80000.000",     // payout available balance (amount available for payouts)
    "product_wallets": []
  },
  "currency_rate": {},
  "customize_currency_transform_rate": {},
  "request_data": null
}

6. Async Callback (notify_url)#

We POST the result to your notify_url with Content-Type: application/json (source IP 54.199.155.234, please whitelist it). Signature verification is the same as for order submission. After processing successfully you must return the plain text success, otherwise we will retry (up to 5 retries, within about 8 minutes).

Callback example: pay-in succeeded

The examples below assume the secret key is abc123; use them to check your own verification code.

POST https://www.example.com/notify
Content-Type: application/json

{
  "order_sn": "AP20261109120530K7Q2M9XA",
  "cus_order_sn": "T20261109001",
  "currency_type": "TWD",
  "original_amount": "1000.00",
  "order_amount": "1000.00",
  "exchange_amount": "1000.00",
  "receive_amount": "1000.00",
  "fee_amount": "41.75",
  "pay_account_code": "34037",
  "status": "success",
  "message": "success",
  "sign": "4c81e676681e89cb8f607618953146af"
}

String to sign (sign removed, keys sorted alphabetically):
currency_type=TWD&cus_order_sn=T20261109001&exchange_amount=1000.00&fee_amount=41.75&message=success&order_amount=1000.00&order_sn=AP20261109120530K7Q2M9XA&original_amount=1000.00&pay_account_code=34037&receive_amount=1000.00&status=success&key=abc123
sign = md5(string above) = 4c81e676681e89cb8f607618953146af

Callback example: payout succeeded

Note that bank_name, account_name and wallet_address are empty strings and are not included in the string to sign.

POST https://www.example.com/notify
Content-Type: application/json

{
  "order_sn": "AP20261109121044P3HV8N2D",
  "cus_order_sn": "W20261109001",
  "currency_type": "TWD",
  "original_amount": "5000.00",
  "order_amount": "5000.00",
  "exchange_amount": "5000.00",
  "status": "success",
  "message": "success",
  "bank_name": "",
  "bank_account": "0123456789012",
  "account_name": "",
  "wallet_address": "",
  "sign": "070271bd9066e415a8c41727deba47db"
}

String to sign:
bank_account=0123456789012&currency_type=TWD&cus_order_sn=W20261109001&exchange_amount=5000.00&message=success&order_amount=5000.00&order_sn=AP20261109121044P3HV8N2D&original_amount=5000.00&status=success&key=abc123
sign = md5(string above) = 070271bd9066e415a8c41727deba47db

Cancelled / voided callbacks have the same format, with status = cancel / fail and message = cancelled / failed.

Verification example (PHP)

$data = json_decode(file_get_contents('php://input'), true);
$sign = isset($data['sign']) ? $data['sign'] : '';
unset($data['sign']);
ksort($data);
$parts = array();
foreach ($data as $k => $v) {
    if ($v === null || $v === '') continue;          // empty values are not signed
    $parts[] = $k . '=' . rawurlencode((string)$v);  // use rawurlencode (space = %20), not urlencode
}
$str = implode('&', $parts) . '&key=' . $secretKey;
if (md5($str) !== strtolower($sign)) { echo 'fail'; exit; }
// ... process the order by cus_order_sn ...
echo 'success';

⚠️ The same order may receive more than one callback (retries, or a cancelled order later becoming voided). Make your handling idempotent on cus_order_sn: return success for orders you have already processed, otherwise we will keep retrying.

7. Order Status#

8. Integration Steps#

1. Whitelist our callback IP 54.199.155.234 and provide your notify_url.
2. We open your merchant account and send you cus_code + secret_key.
3. Place one small test order each for pay-in and payout; go live after callbacks and signatures are verified.

9. Error Codes#

On failure the API returns a unified structure (HTTP 200; check result):

{ "result": "error", "status": 416, "message": "...", "request_data": null }

Appendix: Bank Codes (Taiwan)#

The payout bank_code has no fixed format (3-digit code / Chinese name / 822 中國信託 are all accepted); this table is for reference only. 295 entries, Taiwan financial institution codes. We do not validate this field; if it is not enough to identify the bank, this will only be found at payout time. Please use the codes or names in this table whenever possible.