Skip to main content
Add automatic verification to your Express.js UCP merchant server.

Installation

Copy the middleware file from the GitHub repository:

Basic usage


Configuration options


Response headers


Fail-closed on internal verification errors

If a guard raises an unexpected exception mid-verification, the middleware refuses to forward the request. Instead of calling next() and letting an unverified payload through, it responds with HTTP 500, X-QWED-Verified: false, X-QWED-Error, and code: "INTERNAL_VERIFICATION_ERROR":
The exception detail is logged server-side but not returned to the client, so raw error messages, stack traces, and file paths stay out of the response. Treat a 500 from a /checkout-sessions route the same as a 422 — the request has not been verified and must not be settled.

Fail-closed on unparseable bodies

On a protected path and method, the middleware refuses to forward requests it cannot verify. Empty bodies and bodies that don’t decode to a JSON object are rejected with 422, X-QWED-Verified: false, and code: "UNPARSEABLE_REQUEST" before your handler runs:
Make sure express.json() is registered before createQWEDUCPMiddleware() so the middleware sees the parsed body. Send checkout payloads as application/json with a JSON object at the top level; arrays, primitives, and form-encoded bodies fail closed.

Error response

When verification fails:

Available guards (JavaScript)

The Express.js middleware includes local JavaScript implementations:

Complete example