Upvendo Knowledge Base

Appearance

Uber Eats Integration — Platform Configuration ​

Internal. shared/developer/ is not ingested into Emily's knowledge base. The merchant-facing behaviour lives in shared/integrations/uber-eats.md, which deliberately names none of these variables.

Environment variables ​

The backend requires these environment-level secrets (configured by the Upvendo team, under config('services.uber_eats')):

  • UBER_EATS_CLIENT_ID -- OAuth application client ID
  • UBER_EATS_CLIENT_SECRET -- OAuth application client secret
  • UBER_EATS_REDIRECT_URI -- Redirect URI for the OAuth callback
  • UBER_EATS_WEBHOOK_SECRET -- Shared secret used for webhook signature verification and to HMAC-sign the OAuth state parameter
  • UBER_EATS_SETUP_URL -- Where the OAuth callback redirects the merchant after success
  • UBER_EATS_SANDBOX -- Defaults to true. Read by the back-office controller on both connect and select-store and stored as the integration's is_sandbox, which selects the sandbox or production API base URL for every subsequent call. It must be set to false for real merchants.
  • UBER_EATS_SCOPES -- Space-separated approved scopes; defaults to eats.store eats.store.orders.read eats.store.status.write eats.order. This list drives the capability map, so promotions (eats.store.promotions) and reports (eats.report) are unavailable unless added.
  • UBER_EATS_AUTH_BASE_URL (default https://auth.uber.com/oauth/v2), UBER_EATS_API_BASE_URL (default https://api.uber.com), UBER_EATS_SANDBOX_API_BASE_URL (default https://sandbox-api.uber.com)
  • UBER_EATS_CONNECT_TIMEOUT (default 10s), UBER_EATS_TIMEOUT (default 30s)
  • UBER_EATS_OAUTH_STATE_TTL -- Lifetime of the signed OAuth state, in seconds (default 600)
  • UBER_EATS_REPORT_DOWNLOAD_HOSTS -- Comma-separated host allow-list for report downloads (default api.uber.com,sandbox-api.uber.com)

(Verified: config/services.php lines 178-196.)

Where they surface in behaviour ​

  • OAuth state is HMAC-SHA256 signed with UBER_EATS_CLIENT_SECRET and expires after UBER_EATS_OAUTH_STATE_TTL; the callback redirects to UBER_EATS_SETUP_URL.
  • Webhooks (verify.uber-eats-webhook) verify X-Uber-Signature with UBER_EATS_WEBHOOK_SECRET, falling back to UBER_EATS_CLIENT_SECRET; a bad signature returns 401, an unconfigured secret 503.
  • Sandbox: is_sandbox in the request is ignored; UBER_EATS_SANDBOX (default true) is read on connect and select-store and stored on the record.
  • Scopes: promotions (eats.store.promotions) and reports (eats.report) need adding to UBER_EATS_SCOPES; otherwise those calls return 409 scope_not_approved.
  • Reports: a download URL whose host is not in UBER_EATS_REPORT_DOWNLOAD_HOSTS returns 502 untrusted_report_host.
  • OAuth redirect: UBER_EATS_REDIRECT_URI must match the Uber app settings.