Documentation

Webhooks

Your backend is the source of truth for fulfillment. Each delivery is HMAC-signed and idempotent.

Set the webhook URL in the merchant dashboard. Zap stores a secret starting with whsec_.

Verify signatures

Handler sketch

const sig = req.headers["x-uc-signature"];
const ts = req.headers["x-uc-timestamp"];
// HMAC-SHA256 over "{timestamp}.{rawBody}"
if (!valid(sig, ts, rawBody, secret)) return 401;
if (Math.abs(now - Number(ts)) > 300) return 401;
if (await seen(event.id)) return 200;

Failed deliveries are retried with backoff. Deduplicate using the event id.