In one sentence: museav needs to start accepting payments through WeChat Pay. WeChat’s security model means the keys and certificates can only be generated by you on the merchant platform, so we need about 30 minutes of your time for 6 steps, after which you hand me what you’ve generated.
1. Why This Has to Be Done by You
WeChat Pay grants the right to generate merchant identity credentials only to the super administrator (that’s you).
More importantly, two of them come with a single opportunity:
| Item | Why only once |
|---|---|
| APIv3 key | Once set, the merchant platform never displays it again, and only offers “reset” — resets interrupt live payments |
| Merchant API certificate private key | Can only be exported by the certificate tool; if lost, it cannot be recovered, and the only option is to revoke the certificate and apply again |
As the technical party, I can’t obtain these two; only you can generate them and hand them to me. This isn’t procedural politeness, it’s a hard constraint in WeChat’s design.
2. The 6 Things You Need to Hand Me
| # | Item | What it looks like | Where to get it |
|---|---|---|---|
| 1 | Merchant ID | 10 digits | Merchant platform home / Account Center → Merchant Info |
| 2 | APIv3 key | 32 alphanumeric characters | Account Center → API Security → APIv3 Key → Set |
| 3 | Merchant API certificate | A zip archive (containing 4 files) | Account Center → API Security → Merchant API Certificate → Apply for Certificate |
| 4 | Certificate serial number | 40 alphanumeric characters | Account Center → API Security → Merchant API Certificate → Manage Certificates |
| 5 | WeChat Pay public key | A .pem file + a public key ID string |
Account Center → API Security → WeChat Pay Public Key → Apply for Public Key |
| 6 | AppID | A string starting with wx |
Product Center → AppID Account Management |
For item 3, just send me the whole archive, no need to pick out files.
3. Steps (Follow Along)
Login entry point: https://pay.weixin.qq.com/ — scan the QR code with the super administrator’s WeChat to log in.
Step 0 · First, Set Me as the “Technical Lead” (Important)
[Account Center] → [Account Settings] → find “Security Contact / Technical Lead” and fill in my contact details.
Why do this first: all subsequent security verification reminders and key-change risk notifications go only to the technical lead. If it isn’t set, I won’t get notified when something goes wrong, and I’ll have to wait for you to relay it.
Step 1 · Merchant ID
[Account Center] → [Merchant Info]; it’s right there on the page, 10 digits (like 1230000109).
Step 2 · APIv3 Key ⚠️ Only available once
Path: [Account Center] → [API Security] → [Decryption Callback] → [APIv3 Key] → click “Set”
- The dialog says “please confirm you have communicated with the technical staff” → click “Communicated”
- Enter the 32-character key → click “Confirm”
- Security verification: enter the operation password + SMS code → Confirm
- Click “Done”
⚠️ Once set successfully, the platform no longer displays it; it can only be reset.
✅ Recommended approach: I’ve already generated a 32-character key, so you can just paste it in and set it — that way it succeeds on the first try, without “set some random value, find you can’t see it, then reset.” I’ll send you the key separately.
Purpose: decrypting the notification data WeChat Pay sends back in callbacks. No expiry.
Step 3 · Merchant API Certificate ⚠️ A lost private key cannot be recovered
Path: [Account Center] → [API Security] → [Merchant API Certificate] → click “Apply for Certificate”
This step has to be done on your own computer (it requires installing a small tool) and is a back-and-forth copy-paste process between “platform ↔ tool”:
- Click “Apply for Certificate” → in the dialog, click “Download Certificate Tool”
- Copy the merchant ID and merchant name from the dialog (you’ll paste them into the tool shortly)
- Install and open the certificate tool → choose where to store the certificate → click “Apply for Certificate”
- Paste the merchant ID + merchant name into the tool → Next
- In the tool, click “Copy Certificate Request String”
- Paste the request string back into the input box on the merchant platform → Next
- Security verification: operation password + SMS code → Confirm
- The merchant platform shows “Copy Certificate String” → click copy
- Paste the certificate string back into the certificate tool → Next
- Click “View Certificate Folder”
What you get: a folder containing 4 files — the certificate (p12 format), the certificate (pem format), the certificate private key (pem format), and a readme. Zip up the whole folder and send it to me.
The certificate is valid for 5 years; I’ll remind you to renew before it expires. A merchant ID can have up to 3 valid certificates at the same time, so renewing doesn’t interrupt payments.
Step 4 · Certificate Serial Number
Path: [Account Center] → [API Security] → [Merchant API Certificate] → click “Manage Certificates”; the serial number is right there on the page.
If you can’t find it on the page, that’s fine — I can derive it myself once I have the certificate files.
Step 5 · WeChat Pay Public Key
Path: [Account Center] → [API Security] → [WeChat Pay Public Key] → click “Apply for Public Key”
You get two things:
- A
.pempublic key file - A public key ID string (like
PUB_KEY_ID_xxxxxxxx)
This is WeChat’s official recommended new approach, it never expires, and is less hassle than the old “platform certificate.” It also can be re-downloaded at any time, unlike the key and private key which are one-shot.
Step 6 · Link the AppID
Path: [Product Center] → [AppID Account Management] → [My Linked AppID Accounts] → click “Link”
- You need a verified official account / mini program / mobile app
- You’ll need to fill in entity information and sign an authorization agreement
- A merchant ID can link up to 50
WeChat Pay transactions depend on the binding between AppID and merchant ID — without the binding, placing an order fails outright. While you’re there, confirm whether “Native Payment” under [Product Center] has been activated (some products require a separate application).
4. How to Hand Things Over (Please Mind the Security)
Of these 6 items, items 2 and 3 are the highest sensitivity level: whoever holds them can operate your receiving account.
Please don’t:
- ❌ Post them in a WeChat group (every member can see them, and chat history is retained long-term)
- ❌ Send them in plain text via ordinary email
- ❌ Upload them to a public cloud drive and send the link and password together
Suggested approach:
- ✅ Password-protect the certificate archive before sending, and send the password via a different channel (e.g., read it out over the phone)
- ✅ Tell me the APIv3 key verbally, or split it across two messages (first half + second half)
- ✅ Delete the local temporary files after handover; don’t leave them in the Downloads folder
I’ll store these credentials encrypted; they won’t go into code, and they won’t be uploaded to any code repository.
5. Estimated Time
| Step | Estimate |
|---|---|
| Steps 0 and 1 | 3 minutes |
| Step 2 (APIv3 key) | 5 minutes |
| Step 3 (API certificate) | 15 minutes (including downloading and installing the certificate tool) |
| Steps 4 and 5 | 5 minutes |
| Step 6 (link AppID) | 2 minutes |
| Total | about 30 minutes |
6. If You Get Stuck
| Symptom | Cause | What to do |
|---|---|---|
| Can’t find a menu | The merchant platform was redesigned and the menu moved | Send me a screenshot, I’ll help you locate it |
| No SMS verification code | Super admin’s phone number changed / blocked by the carrier | Check the registered phone number under [Account Center] |
| Certificate tool won’t install | Blocked by the OS security policy | Try another computer, or tell me your OS version |
| “Certificate limit reached” | There are already 3 valid certificates | Revoke an old one, then apply again |
| Review / activation prompts | Some products require review on WeChat’s side | Send me a screenshot and we’ll figure it out together |
If you’re unsure at any step, ask me first — don’t experiment on your own — especially steps 2 and 3, where a mistake is expensive.
This document is delivered via an encrypted link, and access is logged. Please do not forward it to anyone unrelated.
