> ## Documentation Index
> Fetch the complete documentation index at: https://developers.uqpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Verify incoming UQPAY webhook signatures with the Go SDK.

Use `webhook.NewVerifier` with your webhook secret, then pass the unmodified payload and the UQPAY signature headers to `ConstructEvent`.

Before implementing verification, [configure a notification URL](/account-center/v1.6/guide/webhooks-setting) and review the [webhook delivery and security model](/account-center/v1.6/guide/webhooks-overview).

```go theme={null}
import "github.com/uqpay/uqpay-sdk-go/webhook"

verifier := webhook.NewVerifier(webhookSecret)
event, err := verifier.ConstructEvent(
    rawPayload,
    request.Header.Get("x-wk-signature"),
    request.Header.Get("x-wk-timestamp"),
)
if err != nil {
    http.Error(writer, "invalid webhook", http.StatusBadRequest)
    return
}
```

The verifier computes `HMAC-SHA512(secret, rawPayload + timestamp)`, rejects timestamps outside the default five-minute replay window, and parses the common event envelope.

<Warning>
  Verify the original request bytes before decoding JSON. Re-serializing the payload changes the signature input.
</Warning>

Webhook event types remain strings so new server events can be received before a typed payload helper is added.