Upvendo Knowledge Base

Appearance

Deliveroo Integration — Platform Configuration ​

Internal. shared/developer/ is not ingested into Emily's knowledge base. The merchant-facing behaviour lives in shared/integrations/deliveroo.md, which deliberately names none of these variables: a merchant cannot see or change them, and Emily used to repeat them back as troubleshooting steps.

Environment variables ​

The backend requires platform-level secrets (configured by the Upvendo team, not by the merchant), under config('services.deliveroo'):

  • DELIVEROO_ENABLED -- platform kill switch, defaults to false. While it is off, connecting on production fails with "Deliveroo connections are currently disabled". Non-production deployments bypass the gate.
  • DELIVEROO_CLIENT_ID -- OAuth client ID for the Deliveroo API
  • DELIVEROO_CLIENT_SECRET -- OAuth client secret for the Deliveroo API
  • DELIVEROO_WEBHOOK_SECRET -- HMAC secret used to verify incoming order/menu webhooks
  • DELIVEROO_WEBHOOK_VERSION -- expected x-deliveroo-webhook-version header value (default 1)
  • DELIVEROO_CONNECT_TIMEOUT (default 5) / DELIVEROO_TIMEOUT (default 20) / DELIVEROO_MAX_RETRIES (default 2) -- HTTP client tuning for Deliveroo API calls
  • DELIVEROO_MENU_V3_THRESHOLD_BYTES -- payload size at which menu sync switches to the v3 async upload (default 5 MiB)
  • DELIVEROO_PRODUCTION_API_URL / DELIVEROO_SANDBOX_API_URL / DELIVEROO_PRODUCTION_AUTH_URL / DELIVEROO_SANDBOX_AUTH_URL -- host overrides (defaults are the Deliveroo URLs listed under Business Rules)
  • DELIVEROO_ORDER_WEBHOOK_URL / DELIVEROO_MENU_WEBHOOK_URL -- webhook URLs registered with Deliveroo

Where they surface in behaviour ​

  • Kill switch (DELIVEROO_ENABLED): on a production backend with the flag off, connect fails with "Deliveroo connections are currently disabled"; non-production backends bypass it. The Add Channel tile is listed only when the flag is on (OrderingChannelService::onlineChannels).
  • Webhook secret (DELIVEROO_WEBHOOK_SECRET): VerifyDeliverooWebhook verifies HMAC-SHA256 over "{sequence_guid} {raw_body}"; a bad signature returns 401, an unset secret returns 500.
  • Webhook version (DELIVEROO_WEBHOOK_VERSION, default 1): a mismatching x-deliveroo-webhook-version returns 422 "Unsupported webhook version".
  • Menu size threshold (DELIVEROO_MENU_V3_THRESHOLD_BYTES, default 5 MiB): payloads at or above it use the v3 async publish.
  • Client credentials (DELIVEROO_CLIENT_ID / DELIVEROO_CLIENT_SECRET): invalid values surface as "Unable to setup Deliveroo integration" on connect.