Webhooks

Use webhook.NewVerifier with your webhook secret, then pass the unmodified payload and the UQPAY signature headers to ConstructEvent. Before implementing verification, configure a notification URL and review the webhook delivery and security model.

import "github.com/uqpay/uqpay-sdk-go/webhook"

verifier := webhook.NewVerifier(webhookSecret)
event, err := verifier.ConstructEvent(
    rawPayload,
    request.Header.Get("x-wk-signature"),
    request.Header.Get("x-wk-timestamp"),
)
if err != nil {
    http.Error(writer, "invalid webhook", http.StatusBadRequest)
    return
}

The verifier computes HMAC-SHA512(secret, rawPayload + timestamp), rejects timestamps outside the default five-minute replay window, and parses the common event envelope.

Verify the original request bytes before decoding JSON. Re-serializing the payload changes the signature input.

Webhook event types remain strings so new server events can be received before a typed payload helper is added.

MCP

CLI

SDKs