Skip to main content

​
Rules

  1. Verify signatures on the raw body (for example HMAC-SHA256).
  2. Return quickly and offload work to async workers.
  3. Make handlers idempotent using a stable event id.
Full pseudocode and patterns live on Integrations (section Webhooks) — this page exists so developers can find webhooks without mixing them with dashboard OAuth flows.