How to Integrate Alipay Payments into Webman PHP Framework for High‑Performance Apps

Overview

This article uses the high‑performance PHP framework Webman to deeply analyze the integration strategy and practical solution of Alipay payments in modern enterprise systems. Readers will learn a full‑link implementation from sandbox configuration to production deployment, leveraging Webman's asynchronous non‑blocking features and Alipay's RESTful API to build a high‑concurrency payment system with security hardening and transaction status synchronization.

Application Scenarios

The solution targets enterprise applications built with Webman's front‑back separation architecture. Typical scenarios include online store product purchases, membership recharge, and various order payment flows, ensuring efficient, secure fund transfer and an excellent user experience.

Solution

Set up the payment base environment : Register a developer account on Alipay Open Platform, complete identity verification, and obtain necessary permissions and keys.

Integrate the payment SDK : Use Composer to add the Alipay SDK dependency to the project.

Configure and read payment parameters : Store merchant ID, keys, callback URLs, etc., in a configuration file and read them in code.

Write payment business logic : Implement order creation and callback handling, format data per Alipay specifications, and verify notifications.

Create frontend invocation interfaces : Build API endpoints that accept order data from the front end, invoke the payment logic, and return payment links or QR codes.

Step 1: Configure Payment Environment

Log in to Alipay at https://open.alipay.com/develop/manage.

Create an application (see screenshot).

Enter the settings page (see screenshot).

Select the interface signing method (see screenshot).

Download the Alipay key tool (see screenshot).

Generate a CSR file (see screenshot).

Open the generated file (see screenshot).

Proceed to the next step on the Alipay page (see screenshot).

Upload the generated CSR file (see screenshot).

Submit the application and wait for contract approval.

Download the certificate (see screenshot).

Step 2: Integrate Payment SDK

composer require yansongda/pay ~3.0

Step 3: Configure Alipay Parameters

Note: The following documentation uses the Alipay sandbox environment.

Configuration file: config/payment.php (populate with sandbox parameters).

<?php
/**
 * @desc  Payment configuration file
 * @author Tinywan (ShaoBo Wan)
 */
return [
    '_force' => true,
    'alipay' => [
        'default' => [
            // Required – Alipay assigned app_id
            'app_id' => '20160909004708941',
            // Required – Application private key (string or path)
            'app_secret_cert' => 'MIIEpAIBAAKCxxxxxxxxxxxxxxP4r3m4OUmD/+XDgCg==',
            // Required – Application public certificate path
            'app_public_cert_path' => base_path().'/payment/appCertPublicKey_2016090900470841.crt',
            // Required – Alipay public certificate path
            'alipay_public_cert_path' => base_path().'/payment/alipayCertPublicKey_RSA2.crt',
            // Required – Alipay root certificate path
            'alipay_root_cert_path' => base_path().'/payment/alipayRootCert.crt',
            // Optional – Synchronous callback URL
            'return_url' => 'https://webman.tinywan.cn/payment/alipay-return',
            // Optional – Asynchronous callback URL
            'notify_url' => 'https://webman.tinywan.cn/payment/alipay-notify',
            // Optional – Service provider ID (used in service mode)
            'service_provider_id' => '',
            // Optional – Mode (NORMAL, SANDBOX, SERVICE)
            'mode' => \Yansongda\Pay\Pay::MODE_SANDBOX,
        ],
    ],
    'logger' => [
        'enable' => false,
        'file' => runtime_path().'/logs/alipay.log',
        'level' => 'debug', // Use 'info' in production
        'type' => 'single',
        'max_file' => 30,
    ],
    'http' => [
        // Optional
        'timeout' => 5.0,
        'connect_timeout' => 5.0,
    ],
];

Note: The certificate directory is not fixed; the example places files under the payment directory.

├── payment
│   ├── alipayCertPublicKey_RSA2.crt
│   ├── alipayRootCert.crt
│   └── appCertPublicKey_2016090900470841.crt

Step 4: Write Payment Business Logic

Load the configuration and initialize the SDK:

$config = config('payment');
\Yansongda\Pay\Pay::config($config);

Note: In sandbox mode, ensure the 'mode' => \Yansongda\Pay\Pay::MODE_SANDBOX option is enabled.

Step 5: Asynchronous Callback Handling

<?php
use support\Request;
use Yansongda\Pay\Pay;

/**
 * @desc Alipay asynchronous notification
 */
public function alipayNotify(Request $request): Response
{
    // 1. Initialize configuration
    Pay::config(config('payment'));

    // 2. Process Alipay callback
    $result = Pay::alipay()->callback($request->post());

    // TODO: Verify trade_status, out_trade_no, total_amount, seller_id, app_id, etc.

    // 5. Respond to Alipay
    return new Response(200, [], 'success');
}

Do not use return Pay::alipay()->success(); because middleware may interfere; use Webman's response class instead.

Server Asynchronous Notification Page Features

The notification page ( notify_url) must contain no characters such as spaces, HTML tags, or exception messages.

Alipay sends notifications via POST; retrieve parameters using $_POST['out_trade_no'] or equivalent.

Notifications are only sent after a transaction status change.

The interaction is invisible to the user; no page redirects should occur.

On the first status change, both synchronous and asynchronous results are returned.

The page must output exactly the string success (without quotes); otherwise Alipay will retry.

Do not perform redirects on this page; otherwise Alipay treats it as an error.

Cookies and sessions are unavailable on this page.

The page must be reachable over the internet.

The purpose is to prevent order loss when synchronous redirects fail.

The notify_id becomes invalid only after the merchant prints success.

Special Notes

Status TRADE_SUCCESS is triggered when the buyer pays successfully and the merchant’s product supports refunds. Status TRADE_FINISHED is triggered when refunds are not supported or the refund period has expired after a successful payment.

Debugging Process

Payment Request : The front end sends order data (amount, order number, etc.) to the back end.

Obtain Link : The back end calls Alipay’s API with the configured parameters, receives a payment link containing order details.

Redirect to Pay : The back end returns the link; the front end redirects the user to Alipay to complete payment.

Update Status : Alipay sends a server‑side notification to notify_url; the back end validates the data and updates order status, inventory, etc.