Security
Verifying webhook signatures without getting it wrong
Signature verification is four lines of code and three ways to quietly get it wrong. Here is what each one costs you.
Blog
Notes from the people building Ureh
Practical writing on API integration, payments infrastructure, webhooks, security and keeping services up. Everything here describes how the platform actually behaves.
Latest
API Integration
Idempotency keys and the retry you cannot avoid
Every integration retries eventually, usually at the worst possible moment. An idempotency key is what decides whether that retry is harmless or expensive.
Payments
Why wallets debit before they settle
Debiting a wallet before the upstream provider confirms looks backwards until you think about what happens when two purchases arrive at once.
Reliability
Rate limits are a design input, not an error
Most teams discover rate limits by hitting them in production. Reading them first turns a class of incidents into a scheduling decision.
Engineering
Reading a transaction state machine
Pending, queued, processing, success, failed. Knowing which states are terminal is the difference between a correct integration and a polling loop that never stops.