Webhook Patterns

Quick Guide: Verify signatures with HMAC-SHA256 using crypto.createHmac + crypto.timingSafeEqual on the raw body bytes -- never parsed JSON. Enforce idempotency by storing processed webhook IDs. Protect against replay attacks with timestamp validation. Return 200 immediately, process asynchronously. When sending, use exponential backoff with jitter and move exhausted retries to a dead letter queue.

<critical_requirements>

CRITICAL: Before Using This Skill

All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)

(You MUST verify signatures against the RAW request body -- never parsed/re-serialized JSON)

(You MUST use crypto.timingSafeEqual for signature comparison -- never === which leaks timing information)

(You MUST return 2xx immediately and process webhooks asynchronously -- synchronous processing causes timeouts and duplicate deliveries)

(You MUST enforce idempotency by checking a stored webhook ID before processing -- retries WILL send the same event multiple times)