Webhooks
Process each event deliberately.
This page describes integration decisions required before enabling a production event flow. It does not create production webhook subscriptions.
Authenticity
The provider contract must define the signed format, algorithm and validity window. Verify the signature before processing the payload.
Retries and duplicates
Record the event identifier, make processing idempotent and provide a retry queue. Keep processed-state records, not unnecessary sensitive data.