Uber is an ever-growing ecosystem of products and services for people around the world. We want to empower people to pay and get paid with their preferred payment method.

If you are a Payment Service Provider (PSP) or payment partner, you can now integrate with Uber by leveraging Uber Pay APIs.

Use Cases

By building a single API integration with Uber Pay, you will be able to:

• Enable millions of consumers to pay for their ride with Uber or their order on Uber Eats.
• Enable your customers to load money into the Uber ecosystem right from your app or website, thereby increasing customer engagement.
• Enable Uber delivery partners (drivers, couriers, etc) to settle their outstanding arrears using their preferred payment method.
• Provide Uber delivery partners the flexibility to receive payments through their preferred digital wallets.
• Convert loyalty programs points (such as credits or airline miles) into Uber Cash, our stored credits which consumers can spend on rides and Eats orders.
• Feature your payment instruments as an official payment method on Uber.

How it works

Uber Pay is both:

• A specification: a set of endpoints for PSPs to build and expose for the integration to work correctly
• An API: a set of functionalities exposed by Uber for partners to leverage

When you integrate with Uber Pay, you will need to implement a few endpoints on your end for Uber apps to call and initiate the correct flow (e.g. payment method onboarding, money movement, refund, etc).

Uber Pay defines two sets of APIs for PSP Partners to implement:

1. Partner Payment API

Allows Uber to initiate payment transactions, check transaction statuses, initiate refunds and query payment method balance.

2. Partner Payout API

Allows Uber to create payouts.

3. Payment Method Onboarding (Partner OAuth2 API)

Payment method onboarding (via oAuth 2.0 protocol) is available and recommended for improving both the user experience and conversion rate at checkout.

When Partner OAuth2 API integration is not an option, Uber Pay offers the possibility to use a 2FA experience leveraging a webview provided by PSP Partner to authorize the payment every time during checkout.

We already have an API, can’t Uber integrate with it directly?

Uber does integrate directly with Partner’s API, though our engineering teams can only work on so many integrations every year. One of the reasons Uber Pay was born is to allow for Partners to join the Uber ecosystem quickly and more independently.

How flexible is the Uber Pay API?

The Uber Pay integration model standardizes the flow of data between Uber and PSPs. Working with many partners, we have designed our APIs to allow for some flexibility. As a rule of thumb, though, Uber will not be able to adjust said data flows and structures to fit a PSP’s existing infrastructure and/or APIs.

How often will I need to update my integration?

As the Uber Pay APIs evolve, new capabilities will be added that may require changes on the PSP’s end. We will always prioritize supporting backward compatibility. If a breaking change will be needed, we will give ample notice, and do our best to minimize the impact of the work on your end to implement the required changes.

How long does it take to launch a new payment method via Uber Pay?

The bulk of the work will revolve around the PSP building the necessary endpoints following the Uber Pay specification. Once those are in place, and we have validated the integration works, launching a payment method is usually a matter of adding some configurations, testing the flow, and following a gradual rollout plan. Once the first payment method goes live, any subsequent ones will take significantly less.

In order to start using the APIs you need to complete the following phases:

• Sign up on the developer portal
• Configure your account

1. Visit Uber’s developer portal
2. Click "Sign In"
3. Create an Uber account that you will use for developer access.
   • You will need a mobile phone number and a password to create an account.
   • We recommend partners not to use personal account or information.
4. Once you are in the developer portal dashboard, create an app by clicking "+ new app".
5. Note down the client ID of the app. It’s an identifier (not secret or password) to recognize your app. You will use this ID to configure your account.

After you sign up, Uber Pay will configure your newly created app. For us to do so, you’ll need to provide the following:

1. Client ID - From the app that you generated in the previous step.
2. Base URL - Base URL of your Uber Pay implementation. Uber Pay will build absolute URLs by concatenating this base URL you provide with relative paths of the endpoints defined in this spec. For instance /charge endpoint will be called ${BASE_URL}/charge.

In addition to your account, Uber Pay will configure and share the following attributes:

1. Funding method code - We assign a code for each payment method you support.
2. Source account ID - This ID is an internal Uber reference to the Partner's settlement account. Typically there will be multiple of these IDs depending on the number of countries in which you operate. You are expected to generate one reconciliation report per source account ID.

All requests from Uberpay shall have a signature header which is a RSA signature of request-target, Date and Digest headers as per Draft Cavage HTTP Signatures. Section 4.1.1. Example below shows how a charge request from Uber looks like:

curl -X POST \
https://uber.partner.com/v1/payments/charge \
-H 'Accept-Language: pt-BR' \
-H 'Date: Sat, 08 Jun 2019 20:51:35 GMT' \
-H 'Digest: SHA-256=XLnQeHxHWlOkXmqcQaS57rSVfDBUTSUFRpvqZfLxBU0=' \
-H 'Signature: keyId="rsa-key", algorithm="rsa-sha256",
headers="(request-target) host date digest",
signature="dMpg9QKPxwP5l8O6Q7OFC2vNPoJucKga1WKbvPfMY52pi20Hti/mk017OicAuYRfpH9rBsq/6g2wK0m1qqgVNY0UUvIGIrMJd9ii55YacTL/4HAv5CLPFcSDWqFUsA0W8HvvlEk6YgVD052obT6KS0Zd3qJfRJ+qS7KHkSLKAw8="'
-H 'X-Idempotency-Key: c900d4dd-7070-4e0b-9323-8f24cfde0490' \
-H 'Content-Type: application/json' \
-d "{\"destination\": {\"owner_id\": \"dest_owner_id\",\"id\": \"dest_id\",\"type\": \"Account\"},\"source\": {\"owner_id\": \"source_owner_id\",\"id\": \"source_id\",\"type\": \"Account\"},\"amount\": {\"value\": 100000,\"currency\": \"BRL\"},\"description\": \"I'm a deposit in sandbox.\",\"country_iso2\": \"BR\",\"funding_method\": \"BOLETO\",\"initiated_at\": \"2019-06-08T20:51:35Z\",\"session_id\": \"8b31b7f4-3542-4391-817c-d496ce84a7ae\",\"return_url\": \"uber:\/\/payments\/deposit?correlation_id=c900d4dd-7070-4e0b-9323-8f24cfde0490\",\"destination_owner\": {\"type\": \"Customer\",\"id\": \"a66b36d5-887c-4e7c-9edb-9fcbef108e83\",\"uri\": \"\/\/payments\/customers\/a66b36d5-887c-4e7c-9edb-9fcbef108e83\",\"details\": {\"mobile\": \"+123456788\",\"firstname\": \"John\",\"lastname\": \"Doe\"}},\"payment_data\": [{\"type\": \"meal_voucher_payment_data\",\"meal_voucher_merchant_id\": \"15678\"}],\"capture_method\": \"AUTOMATIC\"}"

You can test your requests before you send them to Uber with the OpenSSL cmd-line. For example:

openssl dgst -sha256 -verify {PUBLIC_KEY_FILE} -signature {SIGNATURE_FILE} {DECODED_HEADERS_FILE}

1. PUBLIC_KEY_FILE: Public key file
2. SIGNATURE_FILE: File containing only the signature of the header, base64 decoded. For the above example, this file contains the result of the command.

For example, the SIGNATURE_FILE looks like this:

echo dMpg9QKPxwP5l8O6Q7OFC2vNPoJucKga1WKbvPfMY52pi20Hti/mk017OicAuYRfpH9rBsq/6g2wK0m1qqgVNY0UUvIGIrMJd9ii55YacTL/4HAv5CLPFcSDWqFUsA0W8HvvlEk6YgVD052obT6KS0Zd3qJfRJ+qS7KHkSLKAw8= | base64 -D

3. DECODED_HEADERS_FILE: File containing headers that are being used to form the signature text, for the example above the file looks like this:

(request-target): post /v1/payments/charge
host: uber.partner.com
date: Sat, 08 Jun 2019 20:51:35 GMT
digest: SHA-256=XLnQeHxHWlOkXmqcQaS57rSVfDBUTSUFRpvqZfLxBU0=

Note that for the openssl validation command to work, do not provide a line ending character at the end of DECODED_HEADERS_FILE or SIGNATURE_FILE.

You should only include :{PORT} in case of non-standard ports for the given scheme as we show in the example above. For example, since port 443 is the default port for the https scheme, we don’t include it in the resulting host header text in the above example with URL https://uber.partner.com/v1/payments/charge. If the URL is https://uber.partner.com:9443/v1/payments/charge, then you should provide the host header with uber.partner.com:9443.

We perform signature validation based on the order of the header items are important for the signature validation. Therefore, you should provide it as (request-target), host, date, digest.

You shall receive a public key via email or any of our designated communication channels.

Partner Payment API contains the payment endpoints that the PSP Partner needs to implement in order to integrate with Uber Pay system.

Partner Payout API contains the payout endpoints that the PSP Partner needs to implement in order to integrate with Uber Pay system.

Partner OAuth2 API contains standard RFC6749 OAuth2 endpoints Uber Pay Partner needs to implement.

As part of the integration with Uber Pay, Uber's partners need to be onboarded to Uber's settlement platform for an automatic reconciliation process.

What you need to do before the launch

As part of the integration, we ask you to set up an SFTP folder and safely share its credentials with Uber.

As payments go through your systems, you will generate and place settlement files following an agreed upon format on a given cadence (e.g. weekly).

Once granted access, Uber's systems will be able to automatically fetch the files and ingest them into the settlement platform.