WeChat QR Code Payment

Overview

WeChat QR Code payment allows customers to use WeChat's "Scan" feature to scan a QR code generated by the merchant's website or system and complete the payment process.

In this payment mode:

The merchant system embeds order details into a unique QR Code
The customer scans the code using WeChat and goes through a security check
Once verified, the payment is completed

Common scenarios include:

Desktop web checkout
POS screen QR display
Kiosk/self-service payment terminals

Real-name Verification (Optional)

Merchants may choose to enable WeChat Real-name Verification.

note

Currently, real-name verification is only available for mainland Chinese citizens, and requires:

Payer's full legal name
Chinese National ID number

Verification rules:

If merchant has provided identity data, the payer’s linked wallet/bank info must match
Payments are still allowed even if the customer hasn't linked a bank card
Whether identity verification is enforced depends on merchant settings

Sample Code (Multi-language)

The following examples demonstrate how to call the WeChat QR Code payment API using different languages:

Python
Java
JavaScript (Node.js)
PHP

info

All examples follow the same logic; choose based on your development environment.

Python
Java
JavaScript
Php

#coding=utf8
import urllib.request, urllib.parse, urllib.error, urllib.request, urllib.error, urllib.parse, hashlib
import requests
import datetime
import string

# Enter Client Credentials
environment = 'https://test-openapi-hk.qfapi.com'
app_code = 'D5589D2A1F2E42A9A60C37*********'
client_key = '0E32A59A8B454940A2FF39**********'


# Create parameter values for data payload
current_time = datetime.datetime.now().replace(microsecond=0)                                

print(current_time)

# Create signature
def make_req_sign(data, key):
    keys = list(data.keys())
    keys.sort()
    p = []
    for k in keys: 
        v = data[k]
        p.append('%s=%s'%(k,v))
    unsign_str = ('&'.join(p) + key).encode("utf-8")
    s = hashlib.md5(unsign_str).hexdigest()
    return s.upper()


# Body payload
txamt = '10' #In USD,EUR,etc. Cent. Suggest value > 200 to avoid risk control.
txcurrcd = 'HKD'
pay_type = '800201'
auth_code='283854702356157409' #CPM only
out_trade_no = '01234567890123'
txdtm = current_time
goods_name = 'test1'   
mchid = 'ZaMVg*****'
key = client_key


#data ={'txamt': txamt, 'txcurrcd': txcurrcd, 'pay_type': pay_type, 'out_trade_no': out_trade_no, 'txdtm': txdtm, 'goods_name': goods_name, 'udid': udid, 'mchid': mchid}
data ={'txamt': txamt, 'txcurrcd': txcurrcd, 'pay_type': pay_type, 'out_trade_no': out_trade_no, 'txdtm': txdtm, 'mchid': mchid}

r = requests.post(environment+"/trade/v1/payment",data=data,headers={'X-QF-APPCODE':app_code,'X-QF-SIGN':make_req_sign(data, key)})

print(r.json())

import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;


public class TestMain {
    public static void main(String args[]){
        String appcode="D5589D2A1F2E42A9A60C37*********";
        String key="0E32A59A8B454940A2FF39*********";
        String mchid="ZaMVg*****";

        String pay_type="800201";
        String out_trade_no= "01234567890123";
        SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
        String date=df.format(new Date());
        String txdtm=date;
        String txamt="10";
        String txcurrcd="EUR";

        Map<String, String> unsortMap = new HashMap<>();
        unsortMap.put("mchid", mchid);
        unsortMap.put("pay_type", pay_type);
        unsortMap.put("out_trade_no", out_trade_no);
        unsortMap.put("txdtm", txdtm);
        unsortMap.put("txamt", txamt);
        unsortMap.put("txcurrcd", txcurrcd);
        //unsortMap.put("product_name", product_name);
        //unsortMap.put("valid_time", "300");

        String data=QFPayUtils.getDataString(unsortMap);
        System.out.println("Data:\n"+data+key);
        String md5Sum=QFPayUtils.getMd5Value(data+key);
        System.out.println("Md5 Value:\n"+md5Sum);

        String url="https://test-openapi-hk.qfapi.com";
        String resp= Requests.sendPostRequest(url+"/trade/v1/payment", data, appcode,key);
        System.out.println(resp);
    }
}

// Enter Client Credentials
const environment = 'https://test-openapi-hk.qfapi.com'
const app_code = 'D5589D2A1F2E42A9A60C37*********'
const client_key = '0E32A59A8B454940A2FF39*********'

// Generate Timestamp
var dateTime = new Date().toISOString().replace(/T/, ' ').replace(/\..+/, '')
console.log(dateTime)

// Body Payload
const key = client_key
var tradenumber = String(Math.round(Math.random() * 1000000000))
console.log(tradenumber)

var payload = {
'txamt': '10', // In USD,EUR,etc. Cent. Suggest value > 200 to avoid risk control.
'txcurrcd': 'HKD',
'pay_type': '800201',
'out_trade_no': tradenumber,
'txdtm': dateTime,
'mchid': 'ZaMVg*****'
};

// Signature Generation
const ordered = {};
Object.keys(payload).sort().forEach(function(key) {
  ordered[key] = payload[key] });
console.log(ordered)

var str = [];
for (var p in ordered)
if (ordered.hasOwnProperty(p)) {
str.push((p) + "=" + (ordered[p]));
}
var string = str.join("&")+client_key;
console.log(string)

const crypto = require('crypto')
var hashed = crypto.createHash('md5').update(string).digest('hex')
console.log(hashed)


// API Request
var request = require("request");
request({
  uri: environment+"/trade/v1/payment",
  headers: {
    'X-QF-APPCODE': app_code,
    'X-QF-SIGN': hashed
  },
  method: "POST",
  form: payload,
  }, 
  function(error, response, body) {
  console.log(body);
});

<?php
ob_start();
  function GetRandStr($length){
  $str='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
  $len=strlen($str)-1;
  $randstr='';
  for($i=0;$i<$length;$i++){
  $num=mt_rand(0,$len);
  $randstr .= $str[$num];
  }
  return $randstr;
  }
  
     $url = 'https://test-openapi-hk.qfapi.com';
     $api_type = '/trade/v1/payment';
     $pay_type = '800201';
     //$mchid = "MNxMp11FV35qQN"; //Only agents must provide this parameter
     $app_code = 'FF2FF74F2F2E42769A4A73*********'; //API credentials are provided by QFPay
     $app_key = '7BE791E0FD2E48E6926043B*********'; //API credentials are provided by QFPay
     $now_time = date("Y-m-d H:i:s"); //Get current date-time
     
     $fields_string = '';
     $fields = array(
      //'mchid' => urlencode($mchid),
      'pay_type' => urlencode($pay_type),
      'out_trade_no' => urlencode(GetRandStr(20)),
      'txcurrcd' => urlencode('HKD'),
      'txamt' => urlencode(2200),
      'txdtm' => $now_time
    );
    ksort($fields); //字典排序A-Z升序方式
    print_r($fields);
    
    foreach($fields as $key=>$value) { 
  $fields_string .= $key.'='.$value.'&' ;
  }
  $fields_string = substr($fields_string , 0 , strlen($fields_string) - 1);
  
  $sign = strtoupper(md5($fields_string . $app_key));
  
  //// Header ////
  $header = array();
  $header[] = 'X-QF-APPCODE: ' . $app_code;
  $header[] = 'X-QF-SIGN: ' . $sign;
  
  //Post Data
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $url . $api_type);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
  curl_setopt($ch, CURLOPT_POST, 1);
  curl_setopt($ch, CURLOPT_POSTFIELDS, $fields_string);
  $output = curl_exec($ch);
  curl_close($ch);    

  $final_data = json_decode($output, true);
  print_r($final_data);

ob_end_flush();
?>

API Response

After a successful request, the API will return a QRCode URL for the merchant to convert into a QR image.

info

The returned qrcode field should be rendered into an actual QR Code for customers to scan.

{
  "sysdtm": "2020-04-10 11:45:44", 
  "paydtm": "2020-04-10 11:45:44", 
  "txcurrcd": "HKD", 
  "respmsg": "OK", 
  "qrcode": "weixin://wxpay/bizpayurl?pr=4PsXP5N", 
  "pay_type": "800201", 
  "cardcd": "", 
  "udid": "qiantai2", 
  "txdtm": "2020-04-10 11:45:44", 
  "txamt": "300", 
  "resperr": "success", 
  "out_trade_no": "3Z6HPCS6RN54J2Y8LUQM8RBDVBA9URYE", 
  "syssn": "20200410000300020086358791", 
  "respcd": "0000", 
  "chnlsn": ""
  }

HTTP Request

Method: POST
Endpoint: /trade/v1/payment
PayType: 800201 (WeChat QR Payment)

Request Parameters

Field Name	Parameter	Sub-Param	Required	Type	Description
Transaction Amount	`txamt`	–	Yes	Int(11)	Amount in minor unit (e.g. 100 = $1). Must be integer. Suggest value > 200 to avoid risk flags.
Currency	`txcurrcd`	–	Yes	String(3)	See Supported Currencies.
Payment Type	`pay_type`	–	Yes	String(6)	Always use `800201` for WeChat QR Code Payment. See Payment Types.
Merchant Order ID	`out_trade_no`	–	Yes	String(128)	Merchant-defined order ID. Must be unique per transaction.
Transaction Time	`txdtm`	–	Yes	String(20)	Format: `YYYY-MM-DD hh:mm:ss`
Expiry Time	`expired_time`	–	No	String(3)	Time (in minutes) until QR expires. Default is 30. Range: 5–120 mins.
Product Name	`goods_name`	–	No	String(64)	Name of product. Avoid special characters. UTF-8 encoding recommended for Chinese.
Sub-merchant ID	`mchid`	–	No	String(16)	Required only for agent mode or multi-MID use. Check with support.
Device ID	`udid`	–	No	String(40)	Optional device identifier shown in backend.
RMB Indicator	`rmb_tag`	–	No	String(1)	Set to `Y` if using RMB wallet with currency CNY.
Extended Info	`extend_info`	`user_creid`, `user_truename`	No	Object	Real-name details for mainland Chinese citizens. Example: `{"user_creid":"430067798868676871","user_truename":"\u5c0f\u6797"}`

Response Fields

Field Name	Parameter	Type	Description
Payment Type	`pay_type`	String(6)	Should be `800201` for WeChat QR Code Payment.
System Timestamp	`sysdtm`	String(20)	Time the transaction was processed by QFPay.
Transaction Time	`txdtm`	String(20)	Original timestamp from merchant request.
Status Message	`resperr`	String(128)	Success/failure message.
Paid Amount	`txamt`	Int(11)	Final amount paid.
Additional Message	`respmsg`	String(128)	Any extra return messages.
Merchant Order ID	`out_trade_no`	String(128)	Echoed back from request.
QFPay Order ID	`syssn`	String(40)	Unique transaction ID from QFPay.
Response Code	`respcd`	String(4)	`0000` means success. See Status Codes.
Channel Order ID	`chnlsn`	String	Third-party payment platform order ID (e.g. WeChat transaction number).

warning

If respcd = 1143 or 1145, the transaction is pending. Merchants must call transaction inquiry to confirm final status.

Summary

Best used for displaying QR codes for customers to scan
QR must be generated from returned qrcode field
Real-name verification is optional but available
Always handle response codes carefully and implement order query fallback

WeChat QR Code Payment

Overview​

Real-name Verification (Optional)​

Sample Code (Multi-language)​

API Response​

HTTP Request​

Request Parameters​

Response Fields​

Summary​