How do I stop attackers from sending fake webhooks to my endpoint?

Verify the provider's signature on every delivery. Providers like Stripe and GitHub send an HMAC of the payload computed with a shared secret; recompute it over the raw request body and compare before trusting anything. Also check the timestamp included in the signature scheme to reject replayed requests. Treat an unsigned or unverifiable delivery as hostile and return an error without acting on it.

Why should my webhook handler return 200 before processing the event?

Providers time out slow endpoints and count timeouts as failed deliveries, triggering retries that pile onto the same slow handler. Acknowledging after durably storing the event, in a queue or table, keeps your response under a second regardless of processing cost, and moves retries of failed processing into infrastructure you control instead of the provider's schedule.

If webhooks are real-time, why would I still poll?

Because webhooks can be missed, past the retry window, during misconfigurations, or from provider incidents, and a missed webhook is a permanent gap unless something checks. Polling fetches current state, so any single miss is corrected by the next cycle. Mature integrations use both: webhooks for low latency, a periodic reconciliation poll for correctness.

Communicationchapter 4 of 4 · 3 lessons

Webhooks vs Polling

Webhooks push events to you; polling has you repeatedly ask for updates.

← All chapters View in cheatsheet

When another system has news for you there are two ways to hear it. Keep asking, or hand over an address and let them call you.

The second feels obviously better than asking every ten seconds, right until you are the one responsible for not losing the calls. Losing one is quiet. Nothing appears in your logs, because from your side nothing happened at all, and the first person to notice is a customer asking where their order went.

Lessons

3 in this chapter

How Webhooks WorkYou register a URL, the provider POSTs events to it, and suddenly you run a public endpoint with obligations.2 min
Making Webhooks ReliableAssume deliveries will fail, duplicate, and go missing, then build so none of that loses an event.3 min
When Polling Is Actually RightSometimes the boring loop that asks every minute is the more reliable and cheaper design.3 min