An exposed doorstep
A webhook endpoint receives requests from outside your application. A convincing payload is not enough to establish origin. Treat the endpoint as a security boundary and follow the sender’s documented authentication, signing and delivery contract before allowing an event to affect a payment.
Validate before effect
Where signatures are provided, verify them using the required representation of the request and protected secrets. Check the intended environment and relevant freshness controls. Validation failures belong in a monitored path; they should not silently trigger fulfilment because the event looks plausible.
A delivery example
A request claims that order 812 has been paid, but its signature cannot be validated. Do not ship the order from that message. Preserve safe diagnostic metadata, investigate configuration or tampering, and establish the actual payment state through an authenticated channel if necessary.
Separate reception from work
After validation, record the event durably before running slow downstream tasks. Acknowledge according to the sender’s expectations, and design retries, duplicate handling and observability explicitly. Avoid placing sensitive payloads in unrestricted logs simply because debugging a webhook is inconvenient during a busy operational shift.