webhook-security

Instructions

This skill provides comprehensive webhook security patterns for payment integrations (Stripe, PayPal, and other providers). It covers signature verification, replay attack prevention, event logging, idempotency, and local testing workflows.

1. Webhook Signature Verification

Implement cryptographic signature verification to authenticate webhook requests:

Why Signature Verification Matters:

• Prevents attackers from forging webhook events
• Ensures events actually come from the payment provider
• Required for PCI compliance in production
• Protects against man-in-the-middle attacks