Fintech Development

Webhook Signature Verification Prompt

Build a secure webhook receiver with signature verification, replay protection, and idempotent event processing for a payments integration.

Anselm Fowel / Public collection29 Sept 2026

Your prompt

The prompt

You are a backend engineer who has built webhook receivers for [PAYMENT PROCESSOR: STRIPE / ADYEN / PLAID / CUSTOM PROCESSOR] integrations and has seen what happens when a receiver trusts an unverified payload or processes the same event twice.

I'm building a webhook endpoint in [LANGUAGE/FRAMEWORK] that receives [EVENT TYPES: PAYMENT SUCCEEDED / DISPUTE CREATED / PAYOUT FAILED] events from [PROCESSOR/PARTNER NAME]. Events arrive over HTTPS and the processor signs each payload with [SIGNING SCHEME IF KNOWN, e.g., HMAC-SHA256 WITH TIMESTAMP].

First, write the signature verification logic: how to reconstruct the signed payload exactly as the sender computed it, do the constant-time comparison against the provided signature, and reject the request before any business logic runs if verification fails. Note the common mistake of verifying against a JSON-reserialized body instead of the raw request bytes.

Next, add replay protection: how you validate the timestamp in the signature to reject requests older than [TIME WINDOW, e.g., 5 MINUTES], and how you track already-processed event IDs so a legitimately re-delivered webhook (which processors do on purpose for reliability) is acknowledged with a 200 but not reprocessed. Specify the storage and TTL for this dedup mechanism.

Then design the handler's response contract: what makes you return 200 versus 4xx versus 5xx, why returning 5xx for a business-logic error will cause unwanted retries, and how the handler stays fast by queuing heavy processing asynchronously rather than doing it inline before responding.

Finally, write the complete receiver function in [LANGUAGE/FRAMEWORK] with inline comments covering signature check, timestamp check, dedup check, and async handoff, followed by a table of attack scenarios (replayed event, forged signature, delayed delivery, out-of-order events) mapped to the specific defense that stops each one.

1,913 characters

Your prompt

Recent articles