Allinpay Cross-Border API Signing and Verification Quick Integration

Problem

In cross-border payment integration, signing and verification often require repeated debugging when field order, digest algorithm, header semantics, or private key format are inconsistent. This skill extracts the security layer of the Allinpay cross-border query API into a runnable base, so engineers can validate request signing, response verification, and a minimal call chain before mapping business models.

How It Works

It reads keyid, cusid, merid, and privateKey from integration-config.json first, with optional key file or environment variable fallback. It then generates a minimal project in the customer-specified language, usually including:
- Config loading: reads integration parameters from external config or environment variables
- Signing tool: builds headers using GCP1-RSA-SHA512 and SHA-256 digest
- Verification tool: validates response signatures with the platform public key
- Call entry: invokes the query endpoint and displays the verification result

Boundaries

This skill covers only the query endpoint and the common security layer. It does not generate business DTOs, VOs, state machines, or full service orchestration. Real private keys are not hardcoded by default; external configuration is preferred. For lower Java targets, avoid APIs available only in newer JDK versions, and clean build caches after changes.