Django Example: Create a UPCS Embed Session

A Django project only needs one small view to support the UPCS embed. It calls the session endpoint with the requests library and returns the session_token as JSON.

Settings

# settings.py
import os

UPCS_API_KEY = os.environ.get("UPCS_API_KEY")
UPCS_ORIGIN = os.environ.get("UPCS_ORIGIN", "https://shop.example.com")
UPCS_BASE = "https://api.upcs.io/api"

View

# views.py
import logging

import requests
from django.conf import settings
from django.http import JsonResponse
from django.views.decorators.http import require_GET

log = logging.getLogger(__name__)


@require_GET
def upcs_session(request):
    try:
        resp = requests.post(
            f"{settings.UPCS_BASE}/v1/embed/sessions",
            json={"origin": settings.UPCS_ORIGIN},
            headers={"x-api-key": settings.UPCS_API_KEY},
            timeout=10,
        )
        data = resp.json()
    except (requests.RequestException, ValueError):
        log.exception("UPCS session request failed")
        return JsonResponse({"error": "Map unavailable"}, status=502)

    if not resp.ok or data.get("success") is False:
        log.warning("UPCS error %s %s", resp.status_code, data.get("code"))
        return JsonResponse({"error": "Map unavailable"}, status=502)

    return JsonResponse({
        "session_token": data["session_token"],
        "expires_at": data.get("expires_at"),
    })

URL

# urls.py
from django.urls import path
from . import views

urlpatterns = [
    path("upcs-session/", views.upcs_session, name="upcs-session"),
]

Using it from a template

Your template includes the embed script and fetches /upcs-session/. Remember the trailing slash if you keep Django's default URL behaviour. The complete browser steps are in embed the UPCS map on a website.

Hardening

• Use a fixed origin from settings. See allowed origins explained.
• Rate limit your endpoint, for example with a cache-based throttle, so visitors cannot exhaust your key's hourly limit: rate limits and backoff.
• Mask the key in logs: securing your UPCS API key.

A similar plain-Python function is in create an embed session in Python.