A webhook notifies your endpoint about an event in another system. This convenience means the endpoint is open to the internet and that externally supplied data directly starts processing.
Signature verification is the first gate
Use the provider’s signature mechanism and check replay protections such as timestamps and nonces. HTTPS matters, but alone it does not prove the request came from the right source.
The same event can arrive twice
The same event can repeat because of a network error or the provider’s retry. Storing event IDs and safely ignoring a repeat once processed is the basis of idempotency.
Processing belongs in a queue
Instead of doing long work synchronously in the webhook endpoint and producing timeouts, validate the request, put it safely in a queue and respond fast. That reduces the provider’s retries and the system producing double work.