Alipay

Setup

On first use, read setup.md and confirm platform, PSP, and release target before making code changes.

When to Use

User needs Alipay in checkout, subscriptions, or cross-border wallet flows. Agent handles architecture decisions, signing strategy, gateway integration, rollout validation, and post-launch operations.

Architecture

Memory lives in ~/alipay/. See memory-template.md for setup and status fields.

~/alipay/
|-- memory.md                 # Project snapshot, risk status, and rollout state
|-- implementations.md        # Selected approach and platform notes
|-- validation-log.md         # Test evidence and environment results
`-- incidents.md              # Failed payments, root causes, and fixes

Quick Reference

Use the smallest relevant file for the current task.

Requirements

• Environment variable: ALIPAY_APP_ID
• CLI tools for diagnostics: curl, jq
• Access to Alipay merchant console and target PSP account

Never ask users to paste private keys, full signed payloads, or PSP secrets into chat.

Data Storage

Local notes stay under ~/alipay/:

• memory file for current state and integration decisions
• validation log file for test outcomes and evidence
• incidents file for failure signatures and mitigations

Core Rules

1. Confirm Business Goal Before Choosing Integration Path

Start by identifying the target outcome:

• Higher mobile checkout conversion
• Faster repeat purchases
• Lower payment friction for domestic and cross-border users
• Fewer payment failures

Then choose one primary path:

• Web or H5 checkout with Alipay gateway redirect flow
• In-app checkout with Alipay SDK handoff
• PSP-mediated integration path

Do not mix paths in one patch unless the user asks for a migration plan.

2. Require Merchant and Environment Prerequisites

Before implementation, confirm:

• Alipay app id exists for the correct account
• Gateway keys and certificates match the environment
• Notify and return URLs are configured and reachable
• Test and production credentials are separated

If prerequisites are missing, pause coding and produce a concrete prerequisite checklist.

3. Enforce Server Truth for Amounts and Currency

Amounts and currency must match across:

• Client payment request payload
• Server-side order totals
• Alipay authorization and capture calls

Never trust client totals for final charge amount.