Subscribe to Uber Eats Marketplace order webhooks and verify request signatures

In-depth guide

Steps

1. Register your application in the Uber Developer Dashboard and request the required OAuth scopes including eats.order and eats.store.orders.read.
2. Configure your webhook endpoint URL in the Uber Eats integration settings for the merchant stores you are managing.
3. When an order notification webhook arrives, extract the X-Uber-Signature header from the request.
4. Compute an HMAC-SHA256 signature of the raw request body using your client secret as the key, then lowercase the hexadecimal digest.
5. Compare your computed signature to the value in X-Uber-Signature; reject requests where the signatures do not match to prevent spoofed order injections.
6. Respond with HTTP 200 and an empty body immediately after signature validation; then process the order asynchronously and call the accept_pos_order or deny_pos_order endpoint within 11.5 minutes.