Webhooks

Use signed webhook events for reliable async state updates.

Signature validation

Always verify webhook signatures before processing payloads to prevent spoofed events.

Idempotency

Persist provider event IDs and ignore duplicates. Processing should be safe to retry.

Failure handling

Return non-2xx only for transient failures. Use retry queues and structured logs for permanent error triage.