Designing webhook consumers you can trust

Idempotency, retries, ordering and signature verification — the patterns that keep event-driven integrations correct.

RapidRoot Engineering12 May 2026 7 min

In short

A reliable webhook consumer verifies the signature, responds quickly with 2xx, processes asynchronously, and treats every event as possibly duplicated and possibly out of order. Those four rules prevent nearly all real-world integration bugs.

Always verify the signature before trusting a payload.
Acknowledge fast, process later — slow handlers cause retries and duplicates.
Deduplicate on the event ID; assume at-least-once delivery.
Never assume ordering; use timestamps or sequence numbers in the payload.

Verify before you parse

A webhook endpoint is a public URL. Anyone can post to it. Compute the expected signature over the raw request body and compare it in constant time before doing anything else with the payload.

Raw body, not re-serialised JSON

Parsing and re-encoding the body changes bytes and breaks signature comparison. Keep the raw payload for verification.

Acknowledge fast, work later

1
Receive
Verify, persist the raw event, return 2xx. Target well under a second.
2
Queue
Hand the event to a background worker.
3
Process
Do the slow work — database writes, third-party calls — outside the request.
4
Retry deliberately
Your own retries, with backoff, on your own schedule.

Idempotency and ordering

Delivery is at-least-once, which means duplicates are normal, not exceptional. Store processed event IDs and make handlers safe to run twice. Ordering is not guaranteed either — a 'message.delivered' can arrive before 'message.sent', so reconcile using the timestamps in the payload rather than arrival order.

Handler sketch

if (!verifySignature(rawBody, header)) return res.status(401).end();
const event = JSON.parse(rawBody);
if (await seen(event.id)) return res.status(200).end();
await persist(event);
res.status(200).end();
queue.push(event.id);

Verify, deduplicate, persist, acknowledge — then process asynchronously.

Status at RapidRoot

The public API and webhook delivery are in development. The developer section documents the intended event model so integration work can be planned in advance; endpoints are marked with their current status.

Frequently asked

Are RapidRoot webhooks available today?

They are in development. The Developers section documents the planned event model and marks each capability with its status.

Event model, authentication and integration patterns.

Read the developer docs