Дослідження з перевіркою джерел: Binance Onchainpay B402 Request
Текст статті показано у перевіреному англійському оригіналі. Переклад буде додано після перегляду джерел.
Verified Fact Boundary
1. Binance OnchainPay B402 request-signing documentation describes RSA-SHA256 signatures using a submitted public key. 2. The B402 signing documentation says signed requests include client identity, access token, signature and timestamp headers. 3. The B402 signing documentation says the server validates timestamp freshness and signature input. 4. The B402 signing documentation warns that JSON body bytes and timestamp values must match the signing payload. 5. Binance developer documentation states that documented interfaces are the supported reference for production integrations. 6. A B402 integration must treat verify and settle evidence as signed operational state, not as an unaudited front-end receipt.
Показати менше
Decision Matrix
Таблиця статті: прокрутіть горизонтально або сфокусуйте область таблиці й використовуйте клавіші зі стрілками.
| Check | What it means | Practical action | Unknown to keep explicit |
|---|---|---|---|
| Key custody | request signatures depend on private-key control | store signing material outside source code and screenshots | merchant portal recovery process |
| Serialization | signature verification can fail if body bytes change | serialize JSON once and sign the exact submitted string | middleware reformatting |
| Timestamp | timestamp freshness protects requests from replay | sync clocks and alert on skew before retries | cross-region failover drift |
| Verify call | payment verification should be an explicit signed readback | record verification result before fulfillment | temporary upstream failure |
| Settle call | settlement evidence should be separated from payment presentation | write a non-secret settlement record | provider-side exception handling |
| Retry logic | retries can duplicate signed requests if idempotency is absent | use deterministic request IDs and reconcile before retrying | unknown duplicate effects |
| Stop rule | stop when signature, timestamp, verify or settle evidence is inconsistent | hold payment automation until readback matches | support-only settlement dispute detail |
Source Map
- Binance Developer Docs: OnchainPay B402 API Request Signing (binance-b402-signing)
- Binance Developer Docs: Binance Developer Documentation (binance-developer-intro)
- Binance Developer Docs: Binance Pay Merchant API Specification Common Rules (binance-pay-common)
Control Notes
1. Key custody
Key custody is the decision point where public documentation must become an operating rule. In this package, it means request signatures depend on private-key control. The practical action is to store signing material outside source code and screenshots. The unresolved edge is merchant portal recovery process, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, recovery guarantee, price implication, settlement guarantee or platform ranking.
2. Serialization
Serialization is the decision point where public documentation must become an operating rule. In this package, it means signature verification can fail if body bytes change. The practical action is to serialize JSON once and sign the exact submitted string. The unresolved edge is middleware reformatting, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, recovery guarantee, price implication, settlement guarantee or platform ranking.
The operating test is also narrow. A public page can prove public wording.
3. Timestamp
Timestamp is the decision point where public documentation must become an operating rule. In this package, it means timestamp freshness protects requests from replay. The practical action is to sync clocks and alert on skew before retries. The unresolved edge is cross-region failover drift, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, recovery guarantee, price implication, settlement guarantee or platform ranking.
The operating test is also narrow. A public page can prove public wording.
4. Verify call
Verify call is the decision point where public documentation must become an operating rule. In this package, it means payment verification should be an explicit signed readback. The practical action is to record verification result before fulfillment. The unresolved edge is temporary upstream failure, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, recovery guarantee, price implication, settlement guarantee or platform ranking.
The operating test is also narrow. A public page can prove public wording.
5. Settle call
Settle call is the decision point where public documentation must become an operating rule. In this package, it means settlement evidence should be separated from payment presentation. The practical action is to write a non-secret settlement record. The unresolved edge is provider-side exception handling, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, recovery guarantee, price implication, settlement guarantee or platform ranking.
The operating test is also narrow. A public page can prove public wording.
6. Retry logic
Retry logic is the decision point where public documentation must become an operating rule. In this package, it means retries can duplicate signed requests if idempotency is absent. The practical action is to use deterministic request IDs and reconcile before retrying. The unresolved edge is unknown duplicate effects, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, recovery guarantee, price implication, settlement guarantee or platform ranking.
The operating test is also narrow. A public page can prove public wording.
7. Stop rule
Stop rule is the decision point where public documentation must become an operating rule. In this package, it means stop when signature, timestamp, verify or settle evidence is inconsistent. The practical action is to hold payment automation until readback matches. The unresolved edge is support-only settlement dispute detail, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, recovery guarantee, price implication, settlement guarantee or platform ranking.
The operating test is also narrow. A public page can prove public wording.
Known Unknowns
- merchant portal recovery process
- middleware reformatting
- cross-region failover drift
- temporary upstream failure
- provider-side exception handling
- unknown duplicate effects
- support-only settlement dispute detail
Practical Takeaway
Binance OnchainPay B402 integration should start with signing discipline before any payment workflow is treated as production-ready. Current Binance developer documentation describes RSA-SHA256 request signing, public-key onboarding, timestamp headers, client identity headers and troubleshooting guidance for signature failures. It also frames verify and settle calls as signed API interactions whose body bytes and timestamp must match the signature input. The decision outcome is to define key custody, exact JSON serialization, timestamp tolerance, verification readback, settlement evidence and retry idempotency before connecting B402 payment handling to fulfillment or accounting. The article stops at the evidence boundary. It helps the reader decide what to inspect next without converting public documentation into a promise that a private account, wallet, callback, policy framework, settlement route or liquidity position will work under every future condition.
Джерела
03- OnchainPay B402 API Request Signing · developers.binance.com
- Binance Developer Documentation · developers.binance.com
- Binance Pay Merchant API Specification Common Rules · developers.binance.com