Webhook delivery is an HTTP request from another system, not proof that the claimed sender is genuine. Verify the provider's signature before allowing the payload to trigger an action.
Check authenticity before processing
- Read the provider's current signing specification and verify the signature against the exact raw body it defines.
- Use a maintained cryptographic library and a constant-time comparison for signature bytes.
- Reject invalid signatures and handle timestamp or replay protections when the provider supports them.
Expect retries and duplicate events
Providers may retry after a timeout even when your application already completed the work. Store a stable event identifier and make the handler idempotent so processing the same event twice does not repeat an irreversible action.
Keep signing secrets server-side, rotate them through the provider's documented process, and log only an event identifier and outcome. Never include secret material or the full sensitive payload in an error report.