发卡身份验证

import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.util.Base64;

public class Main {

    public static void main(String[] args) throws Exception {
        KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
        generator.initialize(2048);
        KeyPair keyPair = generator.generateKeyPair();
        System.out.println("\n公钥 Base64（无标记、无换行）：");
        System.out.println(Base64.getEncoder().encodeToString(keyPair.getPublic().getEncoded()));

        System.out.println("\n私钥 Base64（无标记、无换行，自行保存）：");
        System.out.println(Base64.getEncoder().encodeToString(keyPair.getPrivate().getEncoded()));
    }
}

<?php
// 需要启用 PHP 的 OpenSSL 扩展。
$keyPair = openssl_pkey_new([
    'private_key_type' => OPENSSL_KEYTYPE_RSA,
    'private_key_bits' => 2048,
]);
if ($keyPair === false || !openssl_pkey_export($keyPair, $privatePem)) {
    throw new RuntimeException('Failed to generate the RSA key pair');
}
$details = openssl_pkey_get_details($keyPair);
if ($details === false || strpos($privatePem, '-----BEGIN PRIVATE KEY-----') === false) {
    throw new RuntimeException('Failed to export the RSA key pair in the required format');
}
$publicBase64 = preg_replace('/-----BEGIN PUBLIC KEY-----|-----END PUBLIC KEY-----|\s+/', '', $details['key']);
$privateBase64 = preg_replace('/-----BEGIN PRIVATE KEY-----|-----END PRIVATE KEY-----|\s+/', '', $privatePem);

echo '公钥（提交给平台）：' . PHP_EOL;
echo $publicBase64 . PHP_EOL;
echo PHP_EOL . '私钥（自行保存）：' . PHP_EOL;
echo $privateBase64 . PHP_EOL;

# cURL 不生成本地密钥，此处使用 OpenSSL。
set -eu
PRIVATE_KEY="$(openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 2>/dev/null)"

printf '公钥（提交给平台）：\n'
printf '%s\n' "$PRIVATE_KEY" | openssl pkey -pubout -outform DER | openssl base64 -A
printf '\n\n私钥（自行保存）：\n'
printf '%s\n' "$PRIVATE_KEY" | openssl pkcs8 -topk8 -nocrypt -outform DER | openssl base64 -A
printf '\n'

# pip install cryptography
import base64

from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa

key_pair = rsa.generate_private_key(public_exponent=65537, key_size=2048)
public_bytes = key_pair.public_key().public_bytes(
    serialization.Encoding.DER,
    serialization.PublicFormat.SubjectPublicKeyInfo,
)
private_bytes = key_pair.private_bytes(
    serialization.Encoding.DER,
    serialization.PrivateFormat.PKCS8,
    serialization.NoEncryption(),
)

print("公钥（提交给平台）：")
print(base64.b64encode(public_bytes).decode("ascii"))
print("\n私钥（自行保存）：")
print(base64.b64encode(private_bytes).decode("ascii"))

import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.databind.DeserializationFeature;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.SerializationFeature;
import com.fasterxml.jackson.databind.node.ArrayNode;
import com.fasterxml.jackson.databind.node.ObjectNode;

import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.Signature;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.ArrayList;
import java.util.Base64;
import java.util.Collections;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.UUID;

public class MerchantApiRequestExample {
    private static final ObjectMapper MAPPER = new ObjectMapper()
            .enable(DeserializationFeature.USE_BIG_DECIMAL_FOR_FLOATS)
            .enable(SerializationFeature.WRITE_BIGDECIMAL_AS_PLAIN)
            .enable(JsonParser.Feature.STRICT_DUPLICATE_DETECTION)
            .enable(DeserializationFeature.FAIL_ON_TRAILING_TOKENS);

    public static void main(String[] args) throws Exception {
        String apiUrl = "https://YOUR_API_HOST/YOUR_API_PATH";
        String merchantId = "YOUR_MERCHANT_ID";
        String appId = "YOUR_APP_ID"; // 发卡appId
        String privateKey = "YOUR_PRIVATE_KEY"; // PKCS#8 私钥，使用纯 Base64
        String bodyJson = "{}"; // 按实际业务接口填写 JSON

        if (apiUrl.contains("YOUR_") || merchantId.contains("YOUR_") || appId.contains("YOUR_")
                || privateKey.contains("YOUR_")) {
            throw new IllegalArgumentException("Set the API URL, merchantId, FP issuing product ID and private key before running");
        }
        URL url = new URL(apiUrl);
        if (!"https".equalsIgnoreCase(url.getProtocol())) {
            throw new IllegalArgumentException("The API URL must use HTTPS");
        }
        String nonce = UUID.randomUUID().toString();
        String curTime = Long.toString(System.currentTimeMillis());
        String signedString = generateSign(bodyJson, merchantId, appId, nonce, curTime, privateKey);

        Map<String, String> headers = new LinkedHashMap<>();
        headers.put("merchantId", merchantId);
        headers.put("appId", appId);
        headers.put("Nonce", nonce);
        headers.put("curTime", curTime);
        headers.put("signedString", signedString);
        System.out.println(post(url, bodyJson, headers));
    }

    public static String generateSign(String bodyJson, String merchantId, String appId, String nonce,
                                      String curTime, String privateKey) throws Exception {
        JsonNode body = MAPPER.readTree(bodyJson);
        if (body == null || !body.isObject()) {
            throw new IllegalArgumentException("Request body must be a JSON object");
        }
        String sortedString = MAPPER.writeValueAsString(sortJson(body));
        String plainText = sortedString + merchantId + appId + nonce + curTime;
        String keyContent = privateKey.replaceAll("\\s", "");
        PrivateKey key = KeyFactory.getInstance("RSA").generatePrivate(
                new PKCS8EncodedKeySpec(Base64.getDecoder().decode(keyContent)));
        Signature signer = Signature.getInstance("SHA256withRSA");
        signer.initSign(key);
        signer.update(plainText.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(signer.sign());
    }

    private static JsonNode sortJson(JsonNode node) {
        if (node.isObject()) {
            ObjectNode sorted = MAPPER.createObjectNode();
            List<String> fields = new ArrayList<>();
            node.fieldNames().forEachRemaining(fields::add);
            Collections.sort(fields);
            for (String field : fields) {
                sorted.set(field, sortJson(node.get(field)));
            }
            return sorted;
        }
        if (node.isArray()) {
            ArrayNode sorted = MAPPER.createArrayNode();
            for (JsonNode item : node) {
                sorted.add(sortJson(item));
            }
            return sorted;
        }
        return node;
    }

    public static String post(URL url, String bodyJson, Map<String, String> headers) throws Exception {
        byte[] body = bodyJson.getBytes(StandardCharsets.UTF_8);
        HttpURLConnection connection = (HttpURLConnection) url.openConnection();
        try {
            connection.setRequestMethod("POST");
            connection.setDoOutput(true);
            connection.setInstanceFollowRedirects(false);
            connection.setConnectTimeout(10000);
            connection.setReadTimeout(30000);
            connection.setRequestProperty("Content-Type", "application/json; charset=UTF-8");
            for (Map.Entry<String, String> header : headers.entrySet()) {
                connection.setRequestProperty(header.getKey(), header.getValue());
            }
            connection.setFixedLengthStreamingMode(body.length);
            try (OutputStream out = connection.getOutputStream()) {
                out.write(body);
            }
            int status = connection.getResponseCode();
            System.out.println("HTTP status: " + status);
            InputStream response = status >= 400 ? connection.getErrorStream() : connection.getInputStream();
            if (response == null) {
                return "";
            }
            try (InputStream in = response; ByteArrayOutputStream out = new ByteArrayOutputStream()) {
                byte[] buffer = new byte[4096];
                int count;
                while ((count = in.read(buffer)) != -1) {
                    out.write(buffer, 0, count);
                }
                return new String(out.toByteArray(), StandardCharsets.UTF_8);
            }
        } finally {
            connection.disconnect();
        }
    }
}

<?php
// 需要启用 PHP 的 OpenSSL 和 cURL 扩展。
$apiUrl = 'https://YOUR_API_HOST/YOUR_API_PATH';
$merchantId = 'YOUR_MERCHANT_ID';
$appId = 'YOUR_APP_ID';
$privateKey = 'YOUR_PRIVATE_KEY'; // PKCS#8 Base64

// 按第 4 节完成排序后的紧凑 JSON，同时作为实际请求体发送。
$bodyJson = '{"merchantReference":"DEMO-001"}';
if (strpos($apiUrl . $merchantId . $appId . $privateKey, 'YOUR_') !== false) {
    throw new RuntimeException('Set the API URL, merchantId, appId and private key');
}
if (strtolower(parse_url($apiUrl, PHP_URL_SCHEME) ?? '') !== 'https') {
    throw new RuntimeException('The API URL must use HTTPS');
}
$uuidBytes = random_bytes(16);
$uuidBytes[6] = chr((ord($uuidBytes[6]) & 0x0f) | 0x40);
$uuidBytes[8] = chr((ord($uuidBytes[8]) & 0x3f) | 0x80);
$hex = bin2hex($uuidBytes);
$nonce = substr($hex, 0, 8) . '-' . substr($hex, 8, 4) . '-'
    . substr($hex, 12, 4) . '-' . substr($hex, 16, 4) . '-' . substr($hex, 20);
$curTime = (string) (int) floor(microtime(true) * 1000);
$plainText = $bodyJson . $merchantId . $appId . $nonce . $curTime;
$privateKey = "-----BEGIN PRIVATE KEY-----\n"
    . chunk_split(preg_replace('/\s+/', '', $privateKey), 64, "\n")
    . "-----END PRIVATE KEY-----\n";
$key = openssl_pkey_get_private($privateKey);
if ($key === false || !openssl_sign($plainText, $signature, $key, OPENSSL_ALGO_SHA256)) {
    throw new RuntimeException('Failed to sign the request; check the RSA private key');
}
$signedString = base64_encode($signature);
$curl = curl_init($apiUrl);
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $bodyJson,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json; charset=UTF-8',
        'merchantId: ' . $merchantId,
        'appId: ' . $appId,
        'Nonce: ' . $nonce,
        'curTime: ' . $curTime,
        'signedString: ' . $signedString,
    ],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => false,
    CURLOPT_CONNECTTIMEOUT => 10,
    CURLOPT_TIMEOUT => 30,
]);
try {
    $response = curl_exec($curl);
    if ($response === false) {
        throw new RuntimeException(curl_error($curl));
    }
    echo 'HTTP status: ' . curl_getinfo($curl, CURLINFO_HTTP_CODE) . PHP_EOL;
    echo $response . PHP_EOL;
} finally {
    curl_close($curl);
}

curl --request POST 'https://YOUR_API_HOST/YOUR_API_PATH' \
  --header 'Content-Type: application/json; charset=UTF-8' \
  --header 'merchantId: YOUR_MERCHANT_ID' \
  --header 'appId: YOUR_APP_ID' \
  --header 'Nonce: THE_UUID_USED_FOR_SIGNING' \
  --header 'curTime: THE_MILLISECOND_TIMESTAMP_USED_FOR_SIGNING' \
  --header 'signedString: THE_BASE64_SIGNATURE' \
  --data-binary '@request.json'

# pip install requests cryptography
import base64
import time
import uuid

import requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding, rsa

api_url = "https://YOUR_API_HOST/YOUR_API_PATH"
merchant_id = "YOUR_MERCHANT_ID"
app_id = "YOUR_APP_ID"
private_key_text = "YOUR_PRIVATE_KEY"  # PKCS#8 Base64

# 按第 4 节完成排序后的紧凑 JSON，同时作为实际请求体发送。
body_json = '{"merchantReference":"DEMO-001"}'
if any("YOUR_" in value for value in (api_url, merchant_id, app_id, private_key_text)):
    raise ValueError("Set the API URL, merchantId, appId and private key")
if not api_url.lower().startswith("https://"):
    raise ValueError("The API URL must use HTTPS")

private_key = serialization.load_der_private_key(
    base64.b64decode("".join(private_key_text.split()), validate=True), password=None
)
if not isinstance(private_key, rsa.RSAPrivateKey):
    raise ValueError("An RSA private key is required")

nonce = str(uuid.uuid4())
cur_time = str(time.time_ns() // 1_000_000)
plain_text = body_json + merchant_id + app_id + nonce + cur_time
signed_string = base64.b64encode(private_key.sign(
    plain_text.encode("utf-8"), padding.PKCS1v15(), hashes.SHA256()
)).decode("ascii")

response = requests.post(
    api_url,
    data=body_json.encode("utf-8"),
    headers={
        "Content-Type": "application/json; charset=UTF-8",
        "merchantId": merchant_id,
        "appId": app_id,
        "Nonce": nonce,
        "curTime": cur_time,
        "signedString": signed_string,
    },
    timeout=(10, 30),
    allow_redirects=False,
)
print("HTTP status:", response.status_code)
print(response.text)

import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.KeyFactory;
import java.security.MessageDigest;
import java.security.PrivateKey;
import java.security.Signature;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Base64;
import java.util.Locale;
import java.util.UUID;

/** 文件上传调用示例，仅使用 JDK，支持 Java 8 及以上版本。 */
public class MerchantFileUploadExample {
    public static void main(String[] args) throws Exception {
        String apiUrl = "https://api.futurepay-develop.com/api/v1/issuing/reference/upload";
        String merchantId = "YOUR_MERCHANT_ID";
        String appId = "YOUR_APP_ID";
        String privateKey = "YOUR_PRIVATE_KEY"; // PKCS#8，使用纯 Base64
        Path file = Paths.get("front.png");
        if (merchantId.contains("YOUR_") || appId.contains("YOUR_") || privateKey.contains("YOUR_")) {
            throw new IllegalArgumentException("Set merchantId, appId and private key before running");
        }
        long size = Files.size(file);
        if (size == 0 || size > 20L * 1024 * 1024) {
            throw new IllegalArgumentException("File must be non-empty and must not exceed 20 MiB");
        }
        String name = file.getFileName().toString();
        String extension = name.substring(name.lastIndexOf('.') + 1).toLowerCase(Locale.ROOT);
        String mimeType;
        if ("jpg".equals(extension) || "jpeg".equals(extension)) {
            mimeType = "image/jpeg";
        } else if ("png".equals(extension)) {
            mimeType = "image/png";
        } else if ("pdf".equals(extension)) {
            mimeType = "application/pdf";
        } else {
            throw new IllegalArgumentException("Only jpg, jpeg, png and pdf files are supported");
        }

        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        byte[] buffer = new byte[8192];
        try (InputStream in = Files.newInputStream(file)) {
            int count;
            while ((count = in.read(buffer)) != -1) {
                digest.update(buffer, 0, count);
            }
        }
        StringBuilder hex = new StringBuilder(64);
        for (byte value : digest.digest()) {
            hex.append(Character.forDigit((value >>> 4) & 15, 16));
            hex.append(Character.forDigit(value & 15, 16));
        }
        String fileSha256 = hex.toString();
        String nonce = UUID.randomUUID().toString();
        String curTime = Long.toString(System.currentTimeMillis());
        String signingJson = "{\"fileSha256\":\"" + fileSha256 + "\"}";
        String plainText = signingJson + merchantId + appId + nonce + curTime;
        String keyContent = privateKey.replaceAll("\\s", "");
        PrivateKey key = KeyFactory.getInstance("RSA").generatePrivate(
                new PKCS8EncodedKeySpec(Base64.getDecoder().decode(keyContent)));
        Signature signer = Signature.getInstance("SHA256withRSA");
        signer.initSign(key);
        signer.update(plainText.getBytes(StandardCharsets.UTF_8));
        String signedString = Base64.getEncoder().encodeToString(signer.sign());

        String boundary = "----FuturePay" + UUID.randomUUID().toString().replace("-", "");
        byte[] prefix = ("--" + boundary + "\r\n"
                + "Content-Disposition: form-data; name=\"file\"; filename=\"upload." + extension + "\"\r\n"
                + "Content-Type: " + mimeType + "\r\n\r\n").getBytes(StandardCharsets.UTF_8);
        byte[] suffix = ("\r\n--" + boundary + "--\r\n").getBytes(StandardCharsets.UTF_8);
        URL url = new URL(apiUrl);
        if (!"https".equalsIgnoreCase(url.getProtocol())) {
            throw new IllegalArgumentException("The API URL must use HTTPS");
        }
        HttpURLConnection connection = (HttpURLConnection) url.openConnection();
        try {
            connection.setRequestMethod("POST");
            connection.setDoOutput(true);
            connection.setInstanceFollowRedirects(false);
            connection.setConnectTimeout(10000);
            connection.setReadTimeout(60000);
            connection.setRequestProperty("Content-Type", "multipart/form-data; boundary=" + boundary);
            connection.setRequestProperty("merchantId", merchantId);
            connection.setRequestProperty("appId", appId);
            connection.setRequestProperty("Nonce", nonce);
            connection.setRequestProperty("curTime", curTime);
            connection.setRequestProperty("fileSha256", fileSha256);
            connection.setRequestProperty("signedString", signedString);
            connection.setFixedLengthStreamingMode(prefix.length + size + suffix.length);
            try (OutputStream out = connection.getOutputStream()) {
                out.write(prefix);
                Files.copy(file, out);
                out.write(suffix);
            }
            int status = connection.getResponseCode();
            System.out.println("HTTP status: " + status);
            InputStream response = status >= 400 ? connection.getErrorStream() : connection.getInputStream();
            if (response != null) {
                try (InputStream in = response; ByteArrayOutputStream out = new ByteArrayOutputStream()) {
                    int count;
                    while ((count = in.read(buffer)) != -1) {
                        out.write(buffer, 0, count);
                    }
                    System.out.println(new String(out.toByteArray(), StandardCharsets.UTF_8));
                }
            }
        } finally {
            connection.disconnect();
        }
    }
}

<?php
// 需要启用 PHP 的 OpenSSL 和 cURL 扩展。
$apiUrl = 'https://api.futurepay-develop.com/api/v1/issuing/reference/upload';
$merchantId = 'YOUR_MERCHANT_ID';
$appId = 'YOUR_APP_ID';
$privateKey = 'YOUR_PRIVATE_KEY'; // PKCS#8 Base64
$file = __DIR__ . '/front.png';
if (strpos($merchantId . $appId . $privateKey, 'YOUR_') !== false) {
    throw new RuntimeException('Set merchantId, appId and private key');
}
if (!is_file($file) || !is_readable($file)) {
    throw new RuntimeException('The upload file cannot be read');
}
$size = filesize($file);
if ($size === false || $size === 0 || $size > 20 * 1024 * 1024) {
    throw new RuntimeException('File must be non-empty and must not exceed 20MB');
}
$types = ['jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png', 'pdf' => 'application/pdf'];
$extension = strtolower(pathinfo($file, PATHINFO_EXTENSION));
if (!isset($types[$extension])) {
    throw new RuntimeException('Only jpg, jpeg, png and pdf files are supported');
}
$fileSha256 = hash_file('sha256', $file);
if ($fileSha256 === false) {
    throw new RuntimeException('Failed to calculate the file digest');
}
$uuidBytes = random_bytes(16);
$uuidBytes[6] = chr((ord($uuidBytes[6]) & 0x0f) | 0x40);
$uuidBytes[8] = chr((ord($uuidBytes[8]) & 0x3f) | 0x80);
$hex = bin2hex($uuidBytes);
$nonce = substr($hex, 0, 8) . '-' . substr($hex, 8, 4) . '-'
    . substr($hex, 12, 4) . '-' . substr($hex, 16, 4) . '-' . substr($hex, 20);
$curTime = (string) (int) floor(microtime(true) * 1000);
$signingJson = '{"fileSha256":"' . $fileSha256 . '"}';
$plainText = $signingJson . $merchantId . $appId . $nonce . $curTime;
$privateKey = "-----BEGIN PRIVATE KEY-----\n"
    . chunk_split(preg_replace('/\s+/', '', $privateKey), 64, "\n")
    . "-----END PRIVATE KEY-----\n";
$key = openssl_pkey_get_private($privateKey);
if ($key === false || !openssl_sign($plainText, $signature, $key, OPENSSL_ALGO_SHA256)) {
    throw new RuntimeException('Failed to sign the request; check the RSA private key');
}
$curl = curl_init($apiUrl);
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => ['file' => new CURLFile($file, $types[$extension], basename($file))],
    CURLOPT_HTTPHEADER => [
        'merchantId: ' . $merchantId,
        'appId: ' . $appId,
        'Nonce: ' . $nonce,
        'curTime: ' . $curTime,
        'fileSha256: ' . $fileSha256,
        'signedString: ' . base64_encode($signature),
    ],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => false,
    CURLOPT_CONNECTTIMEOUT => 10,
    CURLOPT_TIMEOUT => 60,
]);
try {
    $response = curl_exec($curl);
    if ($response === false) {
        throw new RuntimeException(curl_error($curl));
    }
    echo 'HTTP status: ' . curl_getinfo($curl, CURLINFO_HTTP_CODE) . PHP_EOL;
    echo $response . PHP_EOL;
} finally {
    curl_close($curl);
}

curl 'https://api.futurepay-develop.com/api/v1/issuing/reference/upload' \
  --header "merchantId: ${MERCHANT_ID}" \
  --header "appId: ${APP_ID}" \
  --header "Nonce: ${NONCE}" \
  --header "curTime: ${CUR_TIME}" \
  --header "fileSha256: ${FILE_SHA256}" \
  --header "signedString: ${SIGNED_STRING}" \
  --form 'file=@./front.png;type=image/png'

# pip install requests cryptography
import base64
import hashlib
import time
import uuid
from pathlib import Path

import requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding, rsa

api_url = "https://api.futurepay-develop.com/api/v1/issuing/reference/upload"
merchant_id = "YOUR_MERCHANT_ID"
app_id = "YOUR_APP_ID"
private_key_text = "YOUR_PRIVATE_KEY"  # PKCS#8 Base64
file = Path("front.png")
if any("YOUR_" in value for value in (merchant_id, app_id, private_key_text)):
    raise ValueError("Set merchantId, appId and private key")
size = file.stat().st_size
if size == 0 or size > 20 * 1024 * 1024:
    raise ValueError("File must be non-empty and must not exceed 20MB")
types = {".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", ".pdf": "application/pdf"}
mime_type = types.get(file.suffix.lower())
if mime_type is None:
    raise ValueError("Only jpg, jpeg, png and pdf files are supported")

digest = hashlib.sha256()
with file.open("rb") as source:
    for chunk in iter(lambda: source.read(8192), b""):
        digest.update(chunk)
file_sha256 = digest.hexdigest()
signing_json = '{"fileSha256":"' + file_sha256 + '"}'
nonce = str(uuid.uuid4())
cur_time = str(time.time_ns() // 1_000_000)
plain_text = signing_json + merchant_id + app_id + nonce + cur_time
private_key = serialization.load_der_private_key(
    base64.b64decode("".join(private_key_text.split()), validate=True), password=None
)
if not isinstance(private_key, rsa.RSAPrivateKey):
    raise ValueError("An RSA private key is required")
signed_string = base64.b64encode(private_key.sign(
    plain_text.encode("utf-8"), padding.PKCS1v15(), hashes.SHA256()
)).decode("ascii")

with file.open("rb") as source:
    response = requests.post(
        api_url,
        headers={
            "merchantId": merchant_id,
            "appId": app_id,
            "Nonce": nonce,
            "curTime": cur_time,
            "fileSha256": file_sha256,
            "signedString": signed_string,
        },
        files={"file": (file.name, source, mime_type)},
        timeout=(10, 60),
        allow_redirects=False,
    )
print("HTTP status:", response.status_code)
print(response.text)