Webhook

The delivery contract has to assume failure. Networks drop requests and receivers go down, so any serious sender retries with exponential backoff — which means your endpoint will receive duplicates and must be idempotent. Ordering is not guaranteed either: a completion event can arrive before the event that preceded it, so consumers should reconcile against event timestamps rather than assuming arrival order.

Verification is mandatory, not optional. A signed payload lets the receiver confirm the request came from the platform, and the signature must be computed over the raw body before any parsing or reserialisation, because a re-encoded body produces a different digest. Including a timestamp in the signed material and rejecting old requests is what prevents a captured payload from being replayed later.

The best-practice receiver does very little synchronously: verify the signature, enqueue the payload, return 200. Doing real work inline means slow processing causes sender-side timeouts and retries, which multiplies the load exactly when the system is already struggling. Logging the raw payload before processing also makes failures diagnosable after the fact.