const data = { s:'money', u:'20889012xxxxxxxx', a:'0.04', m:'HM07L520550221254' };
const url = 'alipays://platformapi/startapp?appId=20000123&actionType=scan&biz_data='+JSON.stringify(data);

Never expose real account IDs in client code; sign payload server-side when possible.