Webhooks are how payment platforms tell your system that something happened. Because anyone can send an HTTP request to your endpoint, you must verify that each event is genuine.
Check the HMAC signature using your endpoint secret and a constant-time comparison, reject events whose timestamp is too old, and store processed event IDs so duplicates are ignored. Only then update orders or grant access.
Respond with a 2xx quickly and do heavy work asynchronously — slow responses trigger retries.