Coinfat

Webhooks

Best practices

A short checklist for a robust webhook integration.

Checklist

  • Respond 2xx quickly, then do slow work asynchronously.
  • Always verify the signature before acting on a webhook.
  • Dedupe by event id. The same event can arrive more than once.
  • Verify against the raw request body, not a re-serialized one.
  • Treat webhooks as the source of truth for “paid”, over return URLs.