Webhooks

Set webhook_secret when you create the client, then pass the unmodified request body and headers to construct_event. Before implementing verification, configure a notification URL and review the webhook delivery and security model.

client = UQPayClient(
    client_id="your-client-id",
    api_key="your-api-key",
    webhook_secret="your-webhook-secret",
)

# In your HTTP handler:
from uqpay import UQPayWebhookError

try:
    event = client.webhooks.construct_event(
        raw_body=request.get_data(),
        headers=dict(request.headers),
    )
    print(event["event_type"], event["data"])
except UQPayWebhookError as e:
    return str(e), 400

Pass the original raw request body. Parsing and re-serializing JSON before verification changes the signed bytes and causes verification to fail.

The verifier checks the webhook signature and rejects requests with a timestamp outside the five-minute replay window.

MCP

CLI

SDKs