Webhook Reliability Checklist

Receive safely

• Verify the HMAC signature against the raw request bodyRe-serialized JSON changes the bytes, and signatures fail or get skipped.
• Compare signatures with a timing-safe functionA plain comparison can leak the secret through response-time differences.
• Reject requests whose signed timestamp is more than a few minutes oldOtherwise a captured valid request can be replayed later.
• Push the verified event onto a queue or job tableDoing slow work inline risks blowing the provider's timeout.
• Return a 2xx within the provider's timeout, often a few secondsA late response is treated as failure, which triggers retries and duplicates.