Sign webhooks, reject replays, and retry without duplicate work

#Verify the exact raw request

1. Read the timestamp and signature headers.
2. Reject timestamps outside the permitted window.
3. Compute HMAC over the documented raw bytes, not re-encoded JSON.
4. Compare signatures using a constant-time function.
5. Check the event or idempotency key before creating work.
6. Return a clear accepted or rejected response.

#Create an outbound subscription

Select the smallest event set, use an HTTPS target, protect its secret, and send a test event. The receiver should acknowledge quickly and process slow work asynchronously. Rotate secrets using an overlap procedure if supported.

#Read delivery history before retrying

Inspect attempt time, status, response code, redacted response, and execution correlation. Retry only when the receiver did not complete the business effect or when idempotency makes repetition safe.

#Use typed custom REST operations

Define method, allowed base URL, fields, authentication reference, timeout, response mapping, and version. Test against a sandbox. Do not let ordinary workflow input choose an unrestricted URL.

#Common mistakes

• Signing parsed JSON instead of raw bytes.
• Accepting old signed requests indefinitely.
• Retrying a 500 without checking whether the receiver already committed.

#Verify the result

• Signature and timestamp are verified before parsing.
• Duplicate events are harmless.
• Targets pass outbound URL safety checks.
• Retry decisions use delivery evidence.