开发接入文档

string_to_sign =
      upper(METHOD)                       // "POST"（本平台全部为 POST）
    + "\n" + PATH                         // "/api/heartbeat.php"，不含域名、端口与查询串
    + "\n" + to_int(ts)                   // 裸十进制整数，与 body 里的 ts 同一个值
    + "\n" + hex(sha256(signed_bytes))    // signed_bytes 见下面的空白占位规则

sign = hex(hmac_sha256(site_secret, string_to_sign))

<?php
// 待签串 = METHOD \n PATH \n ts \n sha256(带空 sign 的请求体字节)
function center_sign_v2(string $path, int $ts, string $body, string $secret): string {
    $s2s = "POST\n" . $path . "\n" . $ts . "\n" . hash('sha256', $body);
    return hash_hmac('sha256', $s2s, $secret);
}

// 四步走一遍：$p 里不含 sign
$p['sign'] = '';                                                                  // ① 置空，键放最后
$body = json_encode($p, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);         // ② 紧凑序列化
$sign = center_sign_v2('/api/heartbeat.php', (int) $p['ts'], $body, $site_secret); // ③ 对这段字节签名
$body = str_replace('"sign":""', '"sign":"' . $sign . '"', $body);                // ④ 只回填这一处
// $body 现在就是请求体原文：直接当 content 发出，之后不得再经过任何编码

$ctx = stream_context_create(['http' => [
    'method'  => 'POST',
    'header'  => "Content-Type: application/json\r\n"
               . "X-Sign-Version: 2\r\n"                     // 也可改成体内写 sign_version:2
               . "User-Agent: mysite-center/1.0\r\n",
    'content' => $body,
    'timeout' => 6,
]]);

{"product_key":"cab165d05fcd74f9","site_id":0,"domain":"https://key.dlam.cc","version":"1.0.0","ts":1790000000,"nonce":"a1b2c3d4e5f60718","stats":{"today_pv":128,"order_count":7},"meta":{"php":"7.3.33"},"sign":""}

POST\n/api/heartbeat.php\n1790000000\n2d3d769b9a1a2cd699f1ef027f8a769a57df2f88a875f45c2d2e09560b20174c

{"product_key":"cab165d05fcd74f9","site_id":0,"domain":"https://key.dlam.cc","version":"1.0.0","ts":1790000000,"nonce":"a1b2c3d4e5f60718","stats":{"today_pv":128,"order_count":7},"meta":{"php":"7.3.33"},"sign":"a58c7518c6e2082a98e30ccb056dd5a1a011c165d930cc7954f308a828a6ad7d"}

<?php
function center_canonical(array $d): string {
    ksort($d);
    $p = [];
    foreach ($d as $k => $v) {
        if (is_array($v)) {
            $v = json_encode($v, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
        }
        $p[] = $k . '=' . $v;
    }
    return implode('&', $p);
}

// 传入完整 payload（含或不含 sign 均可），返回签名
function center_sign(array $payload, string $secret): string {
    unset($payload['sign']);                       // sign 自身不参与签名
    return hash_hmac('sha256', center_canonical($payload), $secret);
}

{
  "product_key": "f6b364026d671e44",
  "site_id": 12,
  "domain": "https://shop-a.example.com",
  "version": "1.4.0",
  "ts": 1760000000,
  "nonce": "3f9a1c7b2e8d4a55"
}

domain=https://shop-a.example.com&nonce=3f9a1c7b2e8d4a55&product_key=f6b364026d671e44&site_id=12&ts=1760000000&version=1.4.0

curl -sS https://www.dlam.cc/api/heartbeat.php \
  -H 'Content-Type: application/json' \
  -d '{
    "product_key": "f6b364026d671e44",
    "site_id": 0,
    "domain": "https://shop-a.example.com",
    "version": "1.0.0",
    "ts": 0,
    "nonce": "",
    "sign": ""
  }'

{
  "ok": true,
  "site_id": 12,
  "site_secret": "8f3c1a...e1",
  "license": {
    "status": "正常",
    "expire_at": "2026-11-10",
    "days_left": 30,
    "allow_disable": 0,
    "grace_days": 7,
    "reason": ""
  },
  "plans": [ { "id": 3, "name": "年付", "months": 12, "price": "299.00" } ],
  "pay_note": "转账至 xxx，备注订单号",
  "replies": [],
  "update": null,
  "store": [ { "id": 2, "slug": "stats", "name": "访问统计增强", "price": "0.00", "trial_days": 0 } ],
  "plugins": [],
  "bind_code": "K7QM2XRD",
  "server_notice": "",
  "center_time": "2026-10-11T09:12:00+08:00",
  "sign": "..."
}

<?php
$payload = [
    'product_key' => $st['product_key'],
    'site_id'     => (int) $st['site_id'],
    'domain'      => $domain,
    'plan_id'     => 3,
    'ts'          => time(),
    'nonce'       => bin2hex(random_bytes(8)),
];
// v2：PATH 参数须与请求路径逐字一致；center_body / center_post 见「客户端参考实现」
$body = center_body('/api/renew.php', $payload, $st['site_secret']);
$r    = center_post('/api/renew.php', $body);
// $r = ['ok'=>true,'order_no'=>'RN2026...','amount'=>299,'pay_note'=>'...','sign'=>'...']

<?php
// 关键：先留原文，绝不能 json_decode 后再序列化一次去比对
$raw = @file_get_contents(CENTER_URL . $path, false, $ctx);
if ($raw === false) { /* 连不上中控：记 sync_error，走离线宽限 */ }

$got = '';
foreach ($http_response_header as $h) {
    if (stripos($h, 'X-Center-Sign:') === 0) {
        $got = trim(substr($h, strlen('X-Center-Sign:')));
    }
}
$verified = $got !== ''
    && hash_equals(hash_hmac('sha256', $raw, CENTER_SECRET), $got);
// $verified 为 false 时按你的策略处理：强制对接场景可视为一次同步失败（进离线宽限），不必立即锁站

$j = json_decode($raw, true);
// 这段已内建在「客户端参考实现」的 center_post() 里，单列于此只为说明原理

<?php
function center_verify(array $resp, string $center_secret): bool {
    $sign = $resp['sign'] ?? '';
    unset($resp['sign']);
    return hash_equals(
        hash_hmac('sha256', center_canonical($resp), $center_secret),
        (string) $sign
    );
}

<?php
define('CENTER_URL',    'https://www.dlam.cc');  // 交付时写死为常量、后台只读，防买家改库绕过
define('CENTER_KEY',    'f6b364026d671e44');     // = product_key
define('CENTER_SECRET', '');                     // = center_secret，只用于验响应；留空即跳过验源
define('CENTER_THROTTLE', 300);                  // 心跳节流（秒）
define('CENTER_OFFLINE_GRACE_DAYS', 7);          // 失联宽限期：超过才 fail-closed 锁前台

// 单行状态表：既存连接配置，也存中控回传的授权缓存
// center_state(id=1, center_url, product_key, site_id, site_secret,
//               status, expire_at, cache TEXT, sync_error, last_sync)

// 出站：$body 必须是「已算好签名的那段字节」，本函数内不再做任何编码
function center_post(string $path, string $body): array {
    $ctx = stream_context_create(['http' => [
        'method'  => 'POST',
        'header'  => "Content-Type: application/json\r\nX-Sign-Version: 2\r\nUser-Agent: mysite-center/1.0\r\n",
        'content' => $body,
        'timeout' => 6,
    ]]);
    $raw = @file_get_contents(CENTER_URL . $path, false, $ctx);
    if ($raw === false) return ['error' => '无法连接中控'];

    if (CENTER_SECRET !== '') {                        // 逐字节验源（可选，留空即跳过）
        $got = '';
        foreach ($http_response_header as $h) {
            if (stripos($h, 'X-Center-Sign:') === 0) {
                $got = trim(substr($h, strlen('X-Center-Sign:')));
            }
        }
        if ($got !== '' && !hash_equals(hash_hmac('sha256', $raw, CENTER_SECRET), $got)) {
            return ['error' => '中控响应验签失败'];
        }
    }
    $j = json_decode($raw, true);
    if (!is_array($j)) return ['error' => '中控返回异常'];
    if (empty($j['ok'])) return ['error' => (string) ($j['error'] ?? '中控返回异常')];
    return $j;
}

<?php
// 置空 sign → 紧凑序列化 → 对这段字节签名 → 回填。返回可直接发出的请求体。
// $path 必须与请求实际路径一致，它就是待签串里的 PATH。
function center_body(string $path, array $p, string $secret): string {
    $p['sign'] = '';                                             // 键必须存在，且放在最后
    $body = json_encode($p, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    $s2s  = "POST\n" . $path . "\n" . (int) $p['ts'] . "\n" . hash('sha256', $body);
    return str_replace('"sign":""', '"sign":"' . hash_hmac('sha256', $s2s, $secret) . '"', $body);
}

// 免签登记（site_id=0）用的请求体：同样紧凑序列化，只是不必算签名
function center_body_open(array $p): string {
    $p['sign'] = '';
    return json_encode($p, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
}

<?php
function center_sync(array $st, bool $force = false): array {
    // 1) 节流：未到间隔直接返回旧状态
    if (!$force && !empty($st['last_sync'])
        && (time() - strtotime($st['last_sync'])) < CENTER_THROTTLE) {
        return $st;
    }
    // 2) 组装心跳
    $payload = [
        'product_key' => $st['product_key'],
        'site_id'     => (int) $st['site_id'],
        'domain'      => 'https://shop-a.example.com',   // 固定，且与首登一致
        'version'     => '1.4.0',
        'ts'          => time(),
        'nonce'       => bin2hex(random_bytes(8)),
        'stats'       => ['today_pv' => 128, 'order_count' => 7],
        'meta'        => ['site_name' => '我的站点'],
    ];
    // 3) 已登记才签名；首次登记免签，靠 product_key 引导
    $path   = '/api/heartbeat.php';
    $signed = ((int) $payload['site_id'] > 0 && (string) $st['site_secret'] !== '');
    $body   = $signed ? center_body($path, $payload, $st['site_secret'])
                      : center_body_open($payload);

    $resp = center_post($path, $body);
    if (isset($resp['error'])) {
        // 自愈：身份不符时清空本地 site_id/site_secret，重跑一次走免签登记换回新密钥
        if ($signed && preg_match('/bad signature|not found/i', $resp['error'])) {
            // UPDATE center_state SET site_id=0, site_secret='' ...; return center_sync($st, true);
        }
        // 否则记录 sync_error，供离线宽限期判定（未超 CENTER_OFFLINE_GRACE_DAYS 不误伤）
        return $st;
    }
    // 4) 落库：site_id / site_secret（首登时拿到）+ 整个响应作缓存
    //    UPDATE center_state SET site_id=?, site_secret=?, status=?,
    //      expire_at=?, cache=?, sync_error='', last_sync=NOW() WHERE id=1
    return $resp;
}