WeChat Developer Platform Access Guide

1. Fill in the server configuration
   
2. Verify the validity of the server address
   
3. Implement business logic based on the interface document
   

These 3 steps are described in detail below.

Step 1: Fill in the server configuration

---

After logging in to the official website of the WeChat public platform, go to the development of the official website of the public platform-basic settings page, check the protocol to become a developer, click the "Modify Configuration" button, fill in the server address (URL), Token and EncodingAESKey, where the URL is the interface URL used by developers to receive WeChat messages and events. Token can be filled in by developers and used to generate signatures (the Token will be compared with the Token contained in the interface URL to verify security). EncodingAESKey is manually filled in by the developer or randomly generated, and will be used as the message body encryption and decryption key.

At the same time, developers can choose the message encryption and decryption methods: plain text mode, compatibility mode and security mode. The mode selection and server configuration will take effect immediately after submission. Developers are advised to fill in and select carefully. The default state of encryption and decryption is plaintext mode. To select compatibility mode and security mode, you need to configure the relevant encryption and decryption codes in advance.

Step 2: Verify that the message indeed comes from the WeChat server

---

Development After the user submits the information, the WeChat server will send a GET request to the filled-in server address URL. The GET request carries parameters as shown in the following table:

Parameters	Description
signature	WeChat encrypted signature, signature combines the token parameter filled in by the developer with the timestamp parameter and nonce parameter in the request.
timestamp	Timestamp
nonce	Random number
echostr	Random string

Developers verify the request by checking the signature (the verification method is below). If it is confirmed that this GET request comes from the WeChat server, please return the echostr parameter content as it is, then the access will take effect and you will become a developer successfully, otherwise the access will fail. The encryption/verification process is as follows:

1) Sort the three parameters token, timestamp, and nonce in lexicographic order

2) Splice the three parameter strings into one string for sha1 encryption

3) Developers can obtain the encrypted string Compare with signature to indicate that the request comes from WeChat

PHP sample code to check signature:

private function checkSignature()
{
        $signature = $_GET["signature"];
        $timestamp = $_GET["timestamp"];
        $nonce = $_GET["nonce"];
        
$token = TOKEN;
$tmpArr = array($token, $timestamp, $nonce);
sort($tmpArr, SORT_STRING);
$tmpStr = implode( $tmpArr );
$tmpStr = sha1( $tmpStr );

if( $tmpStr == $signature ){
return true;
}else{
return false;
}
}

Step 3: Implement business logic based on the interface document

---

After successfully verifying the validity of the URL, the access will take effect and you will become a developer. You can apply for WeChat certification on the public platform website. After successful certification, you will receive more interface permissions to meet more business needs.

After becoming a developer, every time the user sends a message to the official account, or generates a custom menu, or generates a WeChat payment order, etc., the server configuration filled in by the developer The URL will receive messages and events pushed from the WeChat server, and developers can respond based on their own business logic, such as replying to messages.

#When the public account calls each interface, it will generally obtain the correct result. The specific results can be found in the description of the corresponding interface. When an error is returned, the cause of the error can be queried based on the return code.

When a user sends a message to a public account, the sender of the message received by the public account is an OpenID, which is the result of encrypting the user's WeChat account. Each user Each official account has a unique OpenID.

In addition, because developers often need to share user accounts and unify account systems across multiple platforms (mobile applications, websites, public accounts), WeChat is open The platform provides a UnionID mechanism. Developers can obtain basic user information through OpenID. If the developer has multiple applications (mobile applications, website applications and public accounts, the public account will only obtain the UnionID after it is bound to the WeChat open platform account). The uniqueness of the user can be distinguished by obtaining the UnionID in the user's basic information, because as long as there are mobile applications, website applications and public accounts under the same WeChat open platform account, the user's UnionID is unique. In other words, the same user has the same UnionID for different applications under the same WeChat open platform account. For details, please view the Resource Center of the WeChat Open Platform - Mobile Application Development - WeChat Login - Authorization Relationship Interface Call Guide - Obtaining User Personal Information (UnionID Mechanism).

Please also note that the WeChat official account interface must start with http:// or https://, which supports port 80 and port 443 respectively.