Get Initial Token (Self-owned Mall App)

## Overview The new Jushuitan open platform (openweb.jushuitan.com) uses an OAuth-style access_token system. Integrations serving a single ERP merchant create a "self-owned mall app"; ISVs serving many merchants create a "service provider app" and follow the authorize-URL + code flow. Once a self-owned app is approved, getInitToken issues the initial access_token/refresh_token pair; refresh before expiry via the refreshToken endpoint. ### Signing rules 1. Sort every request parameter except sign ascending by name (ASCII). 2. Concatenate as key+value pairs with no separator and no URL-encoding. 3. Prepend and append the app_secret. 4. MD5 the result (32-char hex) — that is the sign. Common request parameters: app_key, timestamp (Unix seconds; must be within 10 minutes of Jushuitan server time), charset (utf-8), grant_type and sign. ### Response and usage Success returns code = 0 with data.access_token, data.refresh_token and data.expires_in. Business calls place access_token among the common parameters and re-sign. The Qeasy connector encapsulates token acquisition, caching and automatic renewal. ### Error handling code = 100 means the access_token has timed out — renew it with the refresh_token or re-authorize; code = 10 is an invalid signature — double-check parameter ordering and the app_secret. ### Service-provider flow ISV apps do not call getInitToken directly: they generate an authorization URL, the merchant admin approves it, Jushuitan pushes a code to the ISV callback, and the ISV exchanges that code for the token pair. The callback must answer {"code":0} within the required window, otherwise the platform retries the push and duplicate codes must be handled idempotently.