webhook-integration-patterns

Verify webhook signatures using HMAC-SHA256: compute the expected hash over the timestamp plus raw payload with your secret, then compare using hmac.compare_digest for constant-time comparison. Always validate the timestamp is within 5 minutes to prevent replay attacks.

Handle duplicate webhooks by tracking each event's unique ID in Redis or a database before processing. Acquire a short-lived lock, check if the event was already processed, and store the result with a multi-day TTL so retries return success without reprocessing.

Webhook providers should retry with exponential backoff across at least 5 attempts, such as 10 seconds, 1 minute, 5 minutes, 30 minutes, 1 hour, and up to 24 hours. After exhausting retries, move the event to a dead letter queue for manual review and replay.

Test webhooks locally using ngrok, localtunnel, or Cloudflare Tunnel to expose your localhost server with a public URL. Provider CLIs like stripe listen can forward events directly, and webhook.site lets you inspect raw incoming payloads.

Webhook timeouts happen when you process events synchronously before responding. Acknowledge receipt with a 200 response within 5 seconds, enqueue the event for asynchronous processing, and let a background worker handle the actual business logic.

Rotate webhook secrets by keeping both the current and previous secret active during a grace period, typically 24 hours. Verification tries the current secret first and falls back to the previous one, allowing in-flight webhooks signed with the old secret to succeed.