> ## Documentation Index
> Fetch the complete documentation index at: https://developers.uqpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Verify and handle incoming UQPAY webhook events with the Node.js SDK.

The SDK provides a `constructEvent` method that verifies the webhook signature and returns a typed event object. This ensures the payload has not been tampered with and was sent by UQPAY.

## Prerequisites

Set the `webhookSecret` when you create the client:

```ts theme={null}
const client = new UQPayClient({
  clientId: 'your-client-id',
  apiKey: 'your-api-key',
  webhookSecret: 'whsec_...',
})
```

## Verify and handle events

<Warning>
  Use a raw body parser for your webhook route. Do **not** use `express.json()` — the signature verification requires the original request body as a string or `Buffer`.
</Warning>

```ts theme={null}
import express from 'express'

const app = express()

app.post('/webhooks', express.raw({ type: 'application/json' }), (req, res) => {
  let event

  try {
    event = client.webhooks.constructEvent(req.body, req.headers)
  } catch (err) {
    return res.status(400).send(`Webhook error: ${err.message}`)
  }

  switch (event.event_name) {
    case 'card.create.succeeded':
      // handle the event
      break
  }

  res.json({ received: true })
})
```

The `req.body` passed to `constructEvent` must be the **original request body string or Buffer**, not a parsed JSON object.