OAuth 2.0 Aggregated Login
5 platforms unified access, 5-minute integration
WeChat / Alipay / QQ / Douyin / own site unified access. Complete OAuth 2.0 flow, MD5 signature anti-replay, 5-minute code cache prevents 40163 replay.
<?php
require 'vendor/autoload.php';
$um = new UM($appid, $appkey, $callback, $apiurl);
// 1. 生成登录跳转 URL
$state = bin2hex(random_bytes(16));
$loginUrl = $um->login('wx', $state);
header("Location: $loginUrl");
// 2. 回调获取用户信息
$user = $um->callback($_GET['code']);
// => ["openid"=>"oX...", "nickname"=>"张三", "avatar"=>"..."]
// 3. 二次查询
$info = $um->query('wx', $social_uid);Core features
6 key capabilities, covering everything from basic to advanced
5 platforms unified access
WeChat/Alipay/QQ/Douyin/own site — one SDK covers all
Signature anti-replay
MD5 dictionary order + timestamp valid 5 minutes, eliminates replay attacks
5-minute code cache
Same code can only be consumed once within 5 minutes, prevents 40163 error
state CSRF protection
Optional state parameter returned as-is, prevents cross-site request forgery
4-platform SDK
PHP / JavaScript / Python / Mini-program, auto-generated signatures
Secondary query
Query user info directly via social_uid, no need to re-run OAuth flow
API endpoints
All endpoints accessed via BFF proxy /api/* , auto-handling auth passthrough
| Method | Path | Description |
|---|---|---|
| GET | /connect.php?act=login | Generate redirect URL |
| GET | /connect.php?act=callback | Exchange code for user info |
| GET | /connect.php?act=query | Secondary query via social_uid |
| GET | /connect.php?act=check_sso | SSO status check |