Credentials and integrations
Verify webhooks
Authenticate webhook bytes, validate freshness, prevent replay, acknowledge safely, and process events idempotently.
8 minute lesson
A webhook endpoint is public by design. The payload must prove which provider sent it.
Verify the signature over the exact raw body using the provider’s current scheme and a protected secret or public key. Check timestamp tolerance, store event IDs, and make processing idempotent. Do not log signatures or complete sensitive payloads.
A provider can deliver the same event twice or retry after your response times out. Signature verification proves origin and integrity, but only stored event IDs prevent duplicate fulfillment.
Acknowledge only after durable acceptance, then process asynchronously when work is slow. This reduces provider retries without pretending an in-memory queue can survive a process crash.
Save results for valid, changed, expired, duplicate, unsigned, and wrong-key payloads. Prove only one side effect occurs and a duplicate delivery returns a safe success response.
Lesson completed