Take Payments with Alipay
The AI can already write the payment code for you. Say "help me integrate Alipay" and it will build the buy button, create the order, redirect to Alipay, and mark the order paid once the payment notification arrives.
One thing the AI cannot do for you: the Alipay APPID, keys, and receiving account can only be obtained by you, from the Alipay Open Platform. Those values decide who receives the money, and Alipay only lets the account owner set them up.
So this guide is not about code. It does one thing: help you collect the right values from Alipay and enter them correctly. The AI handles the rest.
Three steps in total:
Collect four values from the Alipay Open Platform (most of this guide)
Enter them in Backend → Integrations in Talizen
Say one sentence to the AI and it wires up the pages
Before You Start
You need an Alipay account with completed business verification that has signed up for "电脑网站支付" (Desktop Website Payment) on the Alipay Open Platform. Personal accounts cannot sign up for this product — that is Alipay's rule and there is no way around it.
Desktop Website Payment is supported today. Mobile web payment, App payment, and in-person payment are not supported yet.
Step 1: Collect Four Values From Alipay
Sign in to the Alipay Open Platform and open the app you use to receive payments. The four values live on two different pages, so they are grouped by page below.
1. APPID
At the top of the app detail page in the left navigation — a number starting with 2021. Copy it.
2. App Private Key and Alipay Public Key
Open Development Settings in the left navigation, find the "Development Info" block, and click View to the right of the first row, "Interface Signing Method (Key / Certificate)". It reads "Set" if you have never configured it.
Do three things on that page:
Use the Alipay Open Platform Development Assistant to generate an RSA2 key pair. Choose key mode, not certificate mode — certificates are not supported yet.
The tool gives you two strings: keep the app private key (you will paste it into Talizen shortly) and upload the app public key on this page.
After a successful upload, the same page shows an Alipay public key. Copy it.
This is the easiest step to get wrong, because three similar-sounding strings are involved:
| Name | Generated by | Purpose | Where it goes |
|---|---|---|---|
| App private key | You (dev assistant) | Signs your requests | Talizen's App private key |
| App public key | You (dev assistant) | Lets Alipay verify your signature | Uploaded to Alipay, not entered in Talizen |
| Alipay public key | Alipay | Lets you verify Alipay's notifications | Talizen's Alipay public key |
While you are there, note the Alipay gateway URL on the same page. For production it is https://openapi.alipay.com/gateway.do, which means you can leave Gateway URL empty in Talizen.
3. AES Key (Most People Can Skip This)
You only need it if the second row of "Development Info", "Interface Content Encryption", shows as configured. Click View and copy the Base64 string. If it was never set up, skip it — nothing later depends on it.
4. Seller PID
This one is not under Development Settings. Open the partner identity page (or Key Management → mapi gateway product keys in the left navigation). The "Partner ID (PID)" at the top of the page is the value — click Copy.
It is a number starting with 2088 and represents the account that actually receives the money. Talizen uses it to confirm that a payment really went to you, so it must match your real receiving account.
Step 2: Enter Everything in Talizen
Open Backend → Integrations in the editor, pick 支付宝 (Alipay) under "Add an app", and fill in the form:
| Field | What to enter |
|---|---|
| Name | A label for yourself. Useful when one site connects several accounts, e.g. "Main receiving account" |
| Channel tags | Distinguishes multiple configs. default is enough; you only need two tags if you have two receiving accounts |
| App private key | The app private key you kept in the previous step (not the app public key) |
| APPID | The number starting with 2021 |
| Seller PID | The number starting with 2088 |
| Alipay public key | The Alipay public key Alipay showed you (not your own app public key) |
| Async notification URL | https://your-production-domain/func/alipay.notify — enter it as-is, see below |
| Return URL | Optional. Which page the payer lands on afterwards; affects experience only |
| AES key | Only if you enabled interface content encryption. Most people leave it empty |
| Gateway URL | Empty means production. Only fill it for sandbox testing |
Enter the Async notification URL as written — you do not need to create anything first. Whether a payment actually arrived can only be told to your site by Alipay's servers calling back. (The payer being redirected to a page is not proof, because anyone can open that page directly.) /func/alipay.notify is the fixed convention, and the AI creates that receiving endpoint for you in step 3, so just enter it now.
The domain must be the one your site is publicly served on — your bound custom domain, or the production domain Talizen gives you after publishing — and it must be https. Do not use a preview domain: Alipay's live notifications cannot reach it. If you change domains later, remember to come back and update this field.
When you click Save, Talizen actually calls Alipay once to validate the whole set, checking four things at once: whether the APPID exists, whether your app private key pairs with the app public key you uploaded, whether the Alipay public key is right, and whether the gateway is correct. A mistake fails immediately, instead of surfacing when a real customer pays.
If Saving Fails
| Error contains | Cause and fix |
|---|---|
isv.invalid-signature | The app private key and the app public key uploaded to Alipay are not the same pair. Generate a new pair with the dev assistant: private key into Talizen, public key to Alipay |
isv.invalid-app-id | Wrong APPID, or a sandbox APPID without the matching sandbox gateway |
| Alipay public key signature failure | You entered your own app public key as the Alipay public key. Go back and copy the string Alipay displays |
isv.decrypt-error | Wrong AES key, or it was changed in the Alipay console |
isv.insufficient-isv-permissions | This app has not signed up for Desktop Website Payment. Enable it in the product signing section |
| App private key format is invalid | The key is incomplete. PKCS#8 and PKCS#1 both work, with or without PEM headers, but characters cannot be missing or mixed with extra content |
Step 3: Let the AI Wire Up the Pages
Once saving succeeds, go back to the editor and tell the AI:
I have connected Alipay. Please wire Alipay payment into my pages.
The AI does the rest: create the endpoint that receives payment notifications, generate orders, connect the buy button to Alipay, and mark orders paid when a notification arrives. It works better if you also say what you sell and what the buyer gets, for example:
I have connected Alipay. Add a "Buy now" button to the course detail page. After a successful payment, show a purchase confirmation, and let me see all orders in the dashboard.
After the AI finishes, publish the site. Alipay only sends payment notifications to a published production domain, so an unpublished site never receives them. Republish every time you change payment-related code.
Three Things to Confirm Afterwards
These are the safety floor for taking money. The AI handles them by default, and you can ask it to confirm:
The price comes from server-side product data, never from the browser — otherwise customers set their own prices.
Only a signature-verified Alipay notification counts as payment. A user landing back on your page does not.
Notifications for the same order arrive more than once, so fulfilment or access granting must take effect only once even on repeated notifications.
Always Make One Real Payment Before Launch
Alipay offers a sandbox so you can walk the whole flow without real money. The sandbox has its own APPID, keys, and gateway URL and cannot be mixed with production: for sandbox, enter the sandbox gateway in Gateway URL and switch the APPID and keys to the sandbox set.
But a passing sandbox test does not prove production works. Before launch, temporarily set a product price to 0.01, make a real payment on the production domain, and confirm the site received the notification and the order flipped to paid. There is no substitute for this step.
FAQ
The payment succeeded but the site did nothing. Check three things in order: whether the Async notification URL is an https address on the published production domain; whether the site has been published (republish after changing payment code); and whether that URL matches the endpoint the AI actually created — just ask the AI "what is my Alipay notification URL" to compare.
Can I use two receiving accounts? Yes. Add two Alipay integrations with different Channel tags, then tell the AI which page collects payment through which tag. Note that the same tag cannot be attached to two payment configs — that is an error, because an order and a receiving account must map one to one.
Can my keys leak? No. The app private key is stored only on the server, and signing and verification both happen on the platform. Site code, logs, and the browser never see it. Payment integrations also forbid exposing keys to code, so the code the AI writes does not contain your keys either.