Building Webhook Endpoints
Webhook endpoints receive requests from external systems such as payment providers, GitHub, email platforms, or deployment systems.
Security is especially important because webhooks are public endpoints. Providers commonly sign requests using a secret so your server can verify authenticity.
Webhook handlers should be idempotent where possible because providers may retry the same event.
Design for Retries
Webhook providers can retry events. Store event identifiers and make processing idempotent to prevent duplicate side effects.
Webhook Skeleton
export async function POST(request: Request) {
const rawBody = await request.text();
const signature = request.headers.get('x-webhook-signature');
verifySignature(rawBody, signature);
const event = JSON.parse(rawBody);
await processWebhookEvent(event);
return new Response('OK');
}💡 Signature verification should happen before trusting the webhook payload.
Key Takeaways
- Verify webhook authenticity.
- Expect duplicate deliveries.
- Make webhook processing idempotent.