Amazon Pay签名生成PHP代码部署及前端JS传值问题排查

1. 签名PHP代码的部署位置 #

• 必须部署在服务器后端（比如你的PHP网站后端目录），绝对不能放在前端页面或公开可访问的静态文件中。因为代码里包含私钥(private_key)，暴露在前端会导致安全风险，被恶意用户盗用后伪造签名。

2. 签名与Payload传递到JS的方式 #

有两种常用方案：

方案一：PHP嵌入HTML页面直接输出 #

把生成签名和Payload的PHP逻辑嵌入到HTML页面中，直接将变量注入到JS代码里：

<?php 
include 'vendor/autoload.php';

$amazonpay_config = array(
    'public_key_id' => 'MY_PUBLIC_KEY_ID',
    'private_key'   => 'keys/private.pem',
    'region'        => 'US',
    'sandbox'       => true
);

$client = new Amazon\Pay\API\Client($amazonpay_config);
// 用数组生成Payload，避免手动写JSON出错
$payloadArray = [
    'storeId' => 'amzn1.application-oa2-client.xxxxx',
    'webCheckoutDetails' => [
        'checkoutReviewReturnUrl' => 'https://example.com/review.html'
    ]
];
$payloadJSON = json_encode($payloadArray);
$signature = $client->generateButtonSignature($payloadJSON);
?>

<div id="AmazonPayButton"></div>
<script src="https://static-na.payments-amazon.com/checkout.js"></script>
<script type="text/javascript" charset="utf-8">
    const amazonPayButton = amazon.Pay.renderButton('#AmazonPayButton', {
        merchantId: 'ABCDEFGHIJK',
        publicKeyId: 'SANDBOX-ABCDEFGHIJKLMNOP',
        ledgerCurrency: 'USD',         
        checkoutLanguage: 'en_US',
        productType: 'PayOnly',
        placement: 'Cart',
        buttonColor: 'Gold',
        estimatedOrderAmount: { "amount": "109.99", "currencyCode": "USD"},
        createCheckoutSessionConfig: {                     
            payloadJSON: <?php echo json_encode($payloadJSON); ?>,
            signature: <?php echo json_encode($signature); ?>
        }   
    });
</script>

这里用json_encode输出变量，能自动处理引号转义，避免JSON格式错误。

方案二：AJAX请求后端接口 #

1. 把签名代码做成独立的API接口（比如generate-signature.php），返回包含payloadJSON和signature的JSON：

<?php
include 'vendor/autoload.php';

header('Content-Type: application/json');

$amazonpay_config = array(
    'public_key_id' => 'MY_PUBLIC_KEY_ID',
    'private_key'   => 'keys/private.pem',
    'region'        => 'US',
    'sandbox'       => true
);

$client = new Amazon\Pay\API\Client($amazonpay_config);
$payloadArray = [
    'storeId' => 'amzn1.application-oa2-client.xxxxx',
    'webCheckoutDetails' => [
        'checkoutReviewReturnUrl' => 'https://example.com/review.html'
    ]
];
$payloadJSON = json_encode($payloadArray);
$signature = $client->generateButtonSignature($payloadJSON);

echo json_encode([
    'payloadJSON' => $payloadJSON,
    'signature' => $signature
]);
?>

2. 前端用AJAX请求该接口，获取数据后渲染按钮：

<div id="AmazonPayButton"></div>
<script src="https://static-na.payments-amazon.com/checkout.js"></script>
<script type="text/javascript" charset="utf-8">
// 先请求签名数据
fetch('generate-signature.php')
    .then(response => response.json())
    .then(data => {
        const amazonPayButton = amazon.Pay.renderButton('#AmazonPayButton', {
            merchantId: 'ABCDEFGHIJK',
            publicKeyId: 'SANDBOX-ABCDEFGHIJKLMNOP',
            ledgerCurrency: 'USD',         
            checkoutLanguage: 'en_US',
            productType: 'PayOnly',
            placement: 'Cart',
            buttonColor: 'Gold',
            estimatedOrderAmount: { "amount": "109.99", "currencyCode": "USD"},
            createCheckoutSessionConfig: {                     
                payloadJSON: data.payloadJSON,
                signature: data.signature
            }   
        });
    })
    .catch(error => console.error('获取签名失败:', error));
</script>

3. "payload is not in correct JSON format" 错误修复 #

你的代码里有三个关键问题：

• JS中estimatedOrderAmount的多余转义：你写的{ \"amount\": \"109.99\", \"currencyCode\": \"USD\"}属于错误写法，JS对象字面量里不需要转义双引号，直接写{ "amount": "109.99", "currencyCode": "USD"}即可。
• createCheckoutSessionConfig里的硬编码值：你写的payloadJSON: 'payload'和signature: 'xxxx'是固定字符串，不是实际生成的Payload和签名，必须替换为后端生成的真实值。
• 手动拼接JSON易出错：建议用PHP的json_encode从数组生成Payload，确保格式完全符合JSON规范。

内容的提问来源于stack exchange，提问作者Erin Griffith