Webhooks let the workflow continue without holding an HTTP request open. A reliable receiver verifies the request and treats repeated delivery as normal.
Verify before processing
Validate the webhook signature against the raw request body and reject events that cannot be authenticated.
Acknowledge quickly
Persist the operation and event ID, return a successful response, then perform slow delivery work asynchronously.
Make retries idempotent
Use the event ID as a uniqueness key. Repeated delivery should resolve to the first accepted event instead of publishing or charging twice.