Institution developer webhooks use at-least-once delivery, so the same event can arrive more than once. A retry or manual replay should not cause your receiver to apply the same effect repeatedly.
After verifying the signature and timestamp, deduplicate by the stable event ID before applying effects. Keep enough processing state to recognize a previously completed event even when its delivery attempt differs.
The signature covers the timestamp, delivery ID, and exact raw request body. Verify that exact representation using the signing secret and a constant-time comparison before trusting the event. Parsing and re-serializing JSON before verification can change the bytes.
Events contain resource references, so fetch current details through the scoped API when needed. A 2xx response acknowledges receipt; it does not complete an unrelated business workflow. If delivery is missed or exhausted, polling resource outcomes provides recovery. Review safe delivery status in Webhooks and avoid logging the signing secret or sensitive resource contents while troubleshooting duplicate notifications.
Was this article helpful?
Tell us whether this answered the question you came with.