Webhooks, signatures and redelivery

Server-to-server events can be delivered more than once.

UnderstandStudy an examplePractise

Understand the concept

A webhook sends an HTTP request between services when an event occurs. Browser CORS is not its access barrier. Verify sender authenticity and integrity using the provider’s documented signature scheme. When signatures cover raw bytes, parsing and reserialising JSON can invalidate verification.

Design replay windows, event identities and idempotent processing. Events may arrive more than once. Durable acceptance followed by background work can help; do not acknowledge an event you can lose.

An IP-only check or query secret is not a strong universal solution. Read delivery, retry and ordering guarantees, then reconcile delayed or reordered events. Provider-specific signature fields are not universal HTTP standards.

WHEN TO USE IT

Process payment, CI and external events reliably.

COMMON PITFALL

Assuming webhook events arrive exactly once.

01 / PRACTICE

One topic. Three levels of depth.

HTTP / illustrative example

POST /hooks/provider HTTP/1.1
Host: example.test
Content-Type: application/json

The receiver is an HTTP endpoint.

This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.

02 / YOUR TURN

Try it yourself first.

Should repeated events create another payment record?

Show the solution and explanation

Worked solution

Same event → one logical business effect

No; use durable deduplication and business idempotency.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.