Webhooks and signature verification
Each webhook endpoint should use HTTPS and verify the signature using the webhook secret. Verify against the raw request body before parsing JSON.
Return a successful response quickly and process longer work in a queue. Store the event identifier so a retried webhook does not create duplicate records. Reject requests with an invalid signature or an unacceptable timestamp difference.