Webhooks notify consumers that business state changed. A production receiver must verify authenticity, acknowledge quickly, tolerate duplicates and reordering, retry safely, and reconcile independently when completeness matters.
Implementation guide
Verify the raw body before processing the event.
Separate delivery acknowledgement from business work.
Use retries and reconciliation together.
Technical example
Use the pattern as a starting point and align URLs, schemas, scopes, timeouts, and error handling with the contract for your environment.
const rawBody = await request.text();
const signature = request.headers.get("x-sc-signature");
const timestamp = request.headers.get("x-sc-timestamp");
verifyWebhook({ rawBody, signature, timestamp, secret });
const event = JSON.parse(rawBody);
await eventStore.recordOnce(event.id, rawBody);
await queue.publish({ eventId: event.id });
return new Response(null, { status: 204 });Production readiness
Signature verification uses the unmodified raw request body
Duplicate delivery produces one business outcome
Slow processing happens after acknowledgement
Replay and reconciliation have runbooks and owners
Continue building
Technical evaluation
Bring the target architecture, representative contracts, volume profile, security requirements, failure cases, and operating responsibilities. We’ll define the smallest useful proof.