Skip to main content
Add automatic verification to your FastAPI UCP merchant server.

Installation


Basic usage


Configuration options


Response headers

The middleware adds verification headers to all responses:

Fail-closed on unparseable bodies

On a protected path and method, the middleware refuses to forward requests it cannot verify. Any of the following returns 422 with X-QWED-Verified: false and code: "UNPARSEABLE_REQUEST" before your handler runs:
  • Empty request body
  • Malformed JSON or non-UTF-8 bytes
  • Valid JSON that decodes to a non-object (array, number, string, null, boolean)
Requests to non-protected paths and methods still pass through untouched — this only applies to routes that match verify_paths and verify_methods. Send checkout payloads as application/json with a JSON object at the top level.

Error response

When verification fails, the middleware returns a 422 response:

Manual verification

For more control, use the dependency injection pattern:

Complete example

Run with: