Webhook Reliability Checklist

Make a webhook endpoint that survives duplicates, delays, and missed events.

16 checks25 minutes

From the guide Webhooks That Never Lose an Event: A Technical Guide

Webhooks are best-effort by design: at least once, sometimes twice, sometimes out of order, occasionally never. A reliable endpoint assumes all of it.

01Receive safely

Verify the HMAC signature against the raw request bodyRe-serialized JSON changes the bytes, and signatures fail or get skipped.
Compare signatures with a timing-safe functionA plain comparison can leak the secret through response-time differences.
Reject requests whose signed timestamp is more than a few minutes oldOtherwise a captured valid request can be replayed later.
Push the verified event onto a queue or job tableDoing slow work inline risks blowing the provider's timeout.
Return a 2xx within the provider's timeout, often a few secondsA late response is treated as failure, which triggers retries and duplicates.

Webhook Reliability Checklist

01Receive safely

02Process exactly once

03Catch what slips through

The rest of the kit is one step away.