# 请求签名

> 了解 Transfer API 的两种签名方式以及对应示例。

Transfer API 提供两种签名方式：`SHA256withRSA` 和 `SHA256`。请使用 Onerway 为您的商户配置的签名方式。

## 开始前说明

<note>

请先确认商户对应的签名方式。两种签名方式使用的密钥类型、签名串规则和输出格式都不相同。

</note>

## SHA256withRSA

### 签名步骤

1. 获取 `privateKey`
2. 使用 `SHA256withRSA` 算法
3. 将待签名字符串转换为 UTF-8
4. 生成签名
5. 对签名结果进行 Base64 编码

### 签名串规则

剔除所有值为空的参数，将剩余参数按参数名 ASCII 顺序排序，然后按 `key=value&key1=value1...` 的格式拼接，最后一个参数后面不加 `&`。

### 示例私钥

```text
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDHaM7clWWlJNS6
ZR5ZkxSFeMMFt74YGRmYPr67UHrfc4CzFtN9sctIUqZJVv05sfOgnb0rk1G7wx97
/LqxPEGs5chc+Nq9HkNf5VopMifOQ85j1Sv1U031oEGk+Oi4MTAR4ZWlLKBQPyKV
b5pCP8aIv15GTIiIwJKS17zY5mQUrXzASTDk54DCG9eN4Lgka9xzwRvaYZvmxLg7
32GxjI5TE797kA5gxY7GxZ0wxdkWkhcee6xX6WWhAcmdHPUUS0EPcnL5wcc3wP07
vO+R/jO1XoaXczb6JRh6ApR3Y5VjSFQApqwe7AIgASGf8aSkBU4K95RfZ3QsBjof
2SX/3fkf
```

### 示例请求数据

```json
{
  "key": "value",
  "key2": "value2",
  "key1": "value2",
  "sign": "RcqXuiVp1JpwJedRGzTpL8M5mUsfeHL29gV9ycaJwmDoNV21AiaQ41au2qiJ8h+jKn/KBMcrJAzHGBTO3CZ0ffGxmqNz9fKhZX+X1MTntH+MhtKTyKR4ZF8kbAtezdVgPfqT69NPQGbWo57R3KP0m4W4n2ZjgkxkcG3yYtBdAgsyxDNoT8W0wH7nK7Y0zp88O8wIMe7kfBnK59J4y0Xz2EwiFX+bNkfRhf3U5WiHIU2TdRbaYsnzndmOkYkVdFAiUH7zoXnEn8ZVqiDZkK4eFG9H1LxU55dStug1hLtwxOKlu5OYFUi4iGAiq0Vlir01eDR1++KAudOdb1gcUyH2rA=="
}
```

### 示例签名串

```text
key=value&key1=value2&key2=value2
```

### 示例签名结果

```text
RcqXuiVp1JpwJedRGzTpL8M5mUsfeHL29gV9ycaJwmDoNV21AiaQ41au2qiJ8h+jKn/KBMcrJAzHGBTO3CZ0ffGxmqNz9fKhZX+X1MTntH+MhtKTyKR4ZF8kbAtezdVgPfqT69NPQGbWo57R3KP0m4W4n2ZjgkxkcG3yYtBdAgsyxDNoT8W0wH7nK7Y0zp88O8wIMe7kfBnK59J4y0Xz2EwiFX+bNkfRhf3U5WiHIU2TdRbaYsnzndmOkYkVdFAiUH7zoXnEn8ZVqiDZkK4eFG9H1LxU55dStug1hLtwxOKlu5OYFUi4iGAiq0Vlir01eDR1++KAudOdb1gcUyH2rA==
```

<code-collapse>

```xml
<dependency>
  <groupId>commons-codec</groupId>
  <artifactId>commons-codec</artifactId>
  <version>1.14</version>
</dependency>
```

```java
package xxx;

import org.apache.commons.codec.binary.Base64;
import java.nio.charset.StandardCharsets;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.Signature;
import java.security.spec.PKCS8EncodedKeySpec;

public class RSASecureDemo {
    public static String signRSA(String privateKey, String toBeSignedData) {
        try {
            byte[] keyBytes = Base64.decodeBase64(privateKey);
            PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(keyBytes);
            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
            PrivateKey priKey = keyFactory.generatePrivate(pkcs8KeySpec);
            Signature signature = Signature.getInstance("SHA256withRSA");
            signature.initSign(priKey);
            signature.update(toBeSignedData.getBytes(StandardCharsets.UTF_8));
            return Base64.encodeBase64String(signature.sign());
        } catch (Exception e) {
            throw new RuntimeException("rsa sign failed");
        }
    }

    public static void main(String[] args) {
        String privateKey = "MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDHaM7clWWlJNS6" +
            "ZR5ZkxSFeMMFt74YGRmYPr67UHrfc4CzFtN9sctIUqZJVv05sfOgnb0rk1G7wx97" +
            "/LqxPEGs5chc+Nq9HkNf5VopMifOQ85j1Sv1U031oEGk+Oi4MTAR4ZWlLKBQPyKV" +
            "483/Axmrwea50UKLqRVH3IXzTOEJth0betqTmbefYFLETn5RXB6MOJQOdzpvvcP3" +
            "05FmtT/grqqcnaeLbosT4A==";

        String toBeSignedData = "key=value&key1=value2&key2=value2";
        String sign = signRSA(privateKey, toBeSignedData);
        System.out.println(sign);
    }
}
```

</code-collapse>

## SHA256

### 签名步骤

1. 获取密钥
2. 将签名串和密钥拼接为字符串
3. 将结果转换为 UTF-8
4. 执行 `SHA-256` 摘要
5. 将摘要结果转换为十六进制字符串

### 签名串规则

剔除所有签名列中为 `No` 的参数，以及值为空的参数。将剩余参数按参数名 ASCII 顺序排序，仅拼接参数值，最后再追加密钥。

### 示例密钥

```text
3b5e10b65bff4172a5b9ca2d2ec00a6e
```

### 示例请求数据

```json
{
  "merchantNo": "800135",
  "test": "dsaaass1dsag",
  "bizContent": "yesdas1dsa",
  "as": "12334567",
  "bc": "098754"
}
```

### 示例签名串

```text
12334567098754yesdas1dsa800135dsaaass1dsag
```

### 示例签名结果

```text
0ce84cc90742e79b3af76da6b6909dc158a2e933057562639fe6a5a8e73f5350
```

<code-collapse>

```xml
<dependency>
  <groupId>org.apache.commons</groupId>
  <artifactId>commons-lang3</artifactId>
  <version>3.6</version>
</dependency>
```

```java
package xxx;

import org.apache.commons.lang3.StringUtils;
import java.security.MessageDigest;
import java.util.TreeMap;

public class SHA256SecureDemo {
    public static void main(String[] args) throws Exception {
        TreeMap data = new TreeMap();
        data.put("merchantNo","800135");
        data.put("test","yesdas1dsa");
        data.put("bizContent","dsaaass1dsag");
        data.put("as","12334567");
        data.put("bc","098754");

        String toBeSignedData = strcatValueSign(data);
        String key = "3b5e10b65bff4172a5b9ca2d2ec00a6e";
        String sign = signSha256(key, toBeSignedData);
        System.out.println(sign);
    }

    private static String strcatValueSign(TreeMap treeMap) {
        StringBuffer buffer = new StringBuffer();
        treeMap.forEach((k, v) -> {
            if (StringUtils.isNotBlank((String) v)) {
                buffer.append(v);
            }
        });
        return buffer.toString();
    }

    public static String signSha256(String key, String toBeSignedData) {
        String str = toBeSignedData + key;
        String encodestr = "";
        try {
            MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
            messageDigest.update(str.getBytes("UTF-8"));
            encodestr = byte2Hex(messageDigest.digest());
        } catch (Exception e) {
            e.printStackTrace();
        }
        return encodestr;
    }

    private static String byte2Hex(byte[] bytes) {
        StringBuffer stringBuffer = new StringBuffer();
        String temp = null;
        for (int i = 0; i < bytes.length; i++) {
            temp = Integer.toHexString(bytes[i] & 0xFF);
            if (temp.length() == 1) {
                stringBuffer.append("0");
            }
            stringBuffer.append(temp);
        }
        return stringBuffer.toString();
    }
}
```

</code-collapse>

## 下一步

- [环境准备](/zh/transfer/get-started)
- [集成流程](/zh/transfer/get-started/integration-flow)
- [测试与上线](/zh/transfer/get-started/testing-and-go-live)