把星选接入你的商城

body_md5 = lowercase_hex(MD5(实际发送的请求体字节))
sign_string = METHOD + "\n" + PATH + "\n" + TIMESTAMP + "\n" + body_md5
signature = lowercase_hex(HMAC_SHA256(API_SECRET, sign_string))

METHOD：大写，例如 GET、POST
PATH：/api/v1/upstream/products，不含域名、? 及查询参数
空请求体的 MD5：d41d8cd98f00b204e9800998ecf8427e
分隔符是实际换行，末尾没有额外换行

{
  "sku_id": 900001,
  "quantity": 1,
  "downstream_order_no": "EXAMPLE-SHOP-ORDER-001",
  "manual_form_data": {"account": "示例账号"},
  "callback_url": "https://your-shop.example/api/v1/upstream/callback",
  "trace_id": "attempt-1"
}

{
  "ok": true,
  "order_id": 900002,
  "order_no": "EXAMPLE-ORDER-900002",
  "status": "delivered",
  "amount": "10.00",
  "refunded_amount": "0.00",
  "currency": "CNY",
  "refund_records": [],
  "fulfillment": {
    "type": "auto",
    "status": "delivered",
    "payload": "EXAMPLE-DELIVERY-CONTENT",
    "delivery_data": {},
    "delivered_at": "2026-11-06T12:00:00+08:00"
  }
}

{
  "event": "order.fulfilled",
  "order_id": 900002,
  "order_no": "EXAMPLE-ORDER-900002",
  "downstream_order_no": "EXAMPLE-SHOP-ORDER-001",
  "status": "delivered",
  "fulfillment": {
    "type": "auto",
    "status": "delivered",
    "payload": "EXAMPLE-DELIVERY-CONTENT",
    "delivery_data": {}
  },
  "timestamp": 1793923200
}

import hashlib, hmac, json, os, time
from urllib import request, error, parse

BASE = "https://xingxuan.si"

class NoRedirect(request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        return None

def signed_request(method, target, payload=None):
    method = method.upper()
    parts = parse.urlsplit(target)
    if parts.scheme or parts.netloc or not parts.path.startswith("/api/v1/upstream/"):
        raise ValueError("Expected a relative Xingxuan API path")
    body = b"" if payload is None else json.dumps(
        payload, ensure_ascii=False, separators=(",", ":")
    ).encode("utf-8")
    timestamp = str(int(time.time()))
    message = "\n".join([method, parts.path, timestamp, hashlib.md5(body).hexdigest()])
    signature = hmac.new(
        os.environ["XINGXUAN_API_SECRET"].encode("utf-8"),
        message.encode("utf-8"), hashlib.sha256
    ).hexdigest()
    return request.Request(BASE + target, data=body if body else None, method=method,
        headers={"Content-Type": "application/json",
            "User-Agent": "Xingxuan-Upstream-Client/1.0",
            "Dujiao-Next-Api-Key": os.environ["XINGXUAN_API_KEY"],
            "Dujiao-Next-Timestamp": timestamp,
            "Dujiao-Next-Signature": signature})

def call(method, target, payload=None):
    req = signed_request(method, target, payload)
    try:
        with request.build_opener(NoRedirect()).open(req, timeout=30) as response:
            return response.status, json.loads(response.read())
    except error.HTTPError as exc:
        try:
            data = json.loads(exc.read())
        except (ValueError, UnicodeDecodeError):
            data = {"ok": False, "error_code": "non_json_response"}
        return exc.code, data
    except error.URLError:
        # A purchase may already exist. Keep its original order key.
        return None, {"ok": False, "error_code": "transport_error"}

if __name__ == "__main__":
    status, data = call("POST", "/api/v1/upstream/ping")
    print(status, data)

function xingxuanSign(string $secret, string $method, string $path,
                      int $timestamp, string $body = ''): string {
    $path = parse_url($path, PHP_URL_PATH);
    $message = strtoupper($method) . "\n" . $path . "\n"
             . $timestamp . "\n" . md5($body);
    return hash_hmac('sha256', $message, $secret);
}
// $body = json_encode($payload,
//     JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
// 将同一份 $body 作为 HTTP 请求体发送，不要再次 json_encode。
// 回调验签时传入固定路径 /api/v1/upstream/callback。

app_key = lowercase_hex(SHA256(UTF8("xingxuan/acgfaka/v1\n" + NATIVE_SECRET)))

PHP:
$appKey = hash('sha256', "xingxuan/acgfaka/v1\n" . $nativeSecret);

Python:
app_key = hashlib.sha256(("xingxuan/acgfaka/v1\n" + native_secret).encode("utf-8")).hexdigest()

\n 表示一个实际换行（LF），不要写成两个字符的反斜杠和 n。

location ^~ /a/ {
    proxy_pass https://xingxuan.si/a/;
    proxy_ssl_server_name on;
    proxy_set_header Host xingxuan.si;
    proxy_set_header X-Real-IP $remote_addr;
}

location ^~ /api/v1/code/ {
    proxy_pass https://xingxuan.si/api/v1/code/;
    proxy_ssl_server_name on;
    proxy_set_header Host xingxuan.si;
    proxy_set_header X-Real-IP $remote_addr;
}

{
  "ok": true,
  "email": "ExampleUser123@outlook.com",
  "code": "839201",
  "subject": "Your Meta confirmation code is 839201",
  "receivedAt": "2026-11-11T08:30:12Z"
}

// POST https://xingxuan.si/api/muse-pool/public/redeem
// Request Body:
{
  "inviteCode": "A1B2C3",
  "voucherCode": "NV1-8F9A2B4C6D1E"
}

// Response (200 OK):
{
  "ok": true,
  "message": "兑换成功！已排入内置自动充值队列",
  "order": {
    "ticket": "2B113FF6",
    "inviteCode": "A1B2C3",
    "uses": 10,
    "done": 0,
    "status": "queued"
  }
}

{
  "ok": true,
  "order": {
    "ticket": "2B113FF6",
    "inviteCode": "A1B2C3",
    "uses": 30,
    "done": 18,
    "status": "running"
  }
}