Webhooks

Webhook receivers must use HTTPS, verify signatures, respond quickly, process asynchronously where possible, and deduplicate by event ID.

Retries#

Expect retries and out-of-order delivery. Handlers must be idempotent so repeated events do not repeat the business action.