Receiver shape
Your receiver should verify the signature, persist the event, respond quickly, and process downstream work from a queue.
Delivery expectations
- Handle duplicate events safely.
- Use idempotency keys where available.
- Keep event processing separate from the HTTP response.
- Log request IDs and timestamps for support.
Test failures
Test invalid signatures, duplicate delivery, delayed processing, and receiver downtime before relying on webhooks for finance automation.