Webhooks you can actually trust: retries, replay, and signing

Webhooks are the nervous system of a payment integration. When one is dropped, an order ships without payment or a customer is charged without confirmation. Reliability is not a nice-to-have here; it is the product.

Delivery guarantees

Every event is delivered at least once. If your endpoint is slow or returns a non-2xx, we retry with exponential backoff for up to 72 hours, then move the event to a dead-letter queue you can inspect and replay from the dashboard.

Verifying a signature

Each request carries a signature header derived from the raw request body and your signing secret. Compute the same HMAC and compare in constant time before trusting a single field.

const expected = hmacSha256(rawBody, signingSecret)
if (!timingSafeEqual(expected, header)) {
  return res.status(400).end()
}

Because delivery is at-least-once, treat every handler as idempotent. Key your side effects on the event id and a replayed event becomes a no-op instead of a double charge.