What it means
Notifications need interpretation
A webhook reports a provider-defined event. The receiver checks the documented authenticity mechanism and interprets the event type, object and identifiers under that provider’s contract. Signature algorithms, signed data and retry behavior are not universal.
Acknowledge and process safely
Design durable acceptance, duplicate handling and business processing as explicit stages. A successful HTTP response communicates according to the sender’s delivery contract; it does not independently prove signature validity, durable storage or completed fulfilment. If events can arrive late or out of order, retrieve or reconcile authoritative state before making an unsafe transition.
Related concepts
Application programming interface, Idempotency, Payment reconciliation, Checkout.
In practice
A concrete example
A store validates a payment event using the sender’s exact scheme, records it durably and applies a duplicate-safe order update.
Technical notes & boundaries
Provider event IDs and delivery IDs can serve different purposes. In particular, GitHub’s X-GitHub-Delivery behavior must be read from GitHub documentation rather than generalized from another provider.
Go to the source.
Original references used for this definition. Product details and standards can change.