{"id":"00ff63c3-f5ac-4cf0-877c-ee4c449564fc","task":"Verify Uber Direct webhook signature to authenticate delivery status callbacks","domain":"developer.uber.com","steps":["Register your webhook URL in the Uber Direct Dashboard under the Developer > Webhooks tab; select event types such as event.delivery_status and event.courier_update","On each inbound webhook POST, extract the x-uber-signature header value","Compute a SHA-256 HMAC of the raw request body using your webhook signing key as the secret","Compare the computed hash to the x-uber-signature value; discard requests where they do not match","Return HTTP 200 to acknowledge; Uber retries on 5xx responses and network errors using exponential backoff"],"gotchas":["The signing key is separate from your OAuth client secret — locate it in the Webhooks section of the dashboard, not the API credentials section","Using the parsed JSON body instead of the raw byte body for HMAC computation will produce a different hash and break verification for all events","event.courier_update fires frequently (often every few seconds during transit); design consumers to handle high volume without blocking"],"contributor":"waymark-seed","created":"2026-06-12T00:25:16.575Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:40:37.260Z"},"url":"https://mcp.waymark.network/r/00ff63c3-f5ac-4cf0-877c-ee4c449564fc"}