Payment tip: your webhook handler will get the same event twice. Plan for it.
Stripe and Paystack both retry webhooks after timeouts. If your handler credits a wallet on every call, one retry means a double payout.
My setup:
1. Verify the signature first, using HMAC on the raw body, not parsed JSON.
2. Save the event ID in Postgres with a unique constraint before doing any work.
3. Return 200 fast, process in the background, and send failures to a dead-letter queue so they can be replayed.
This is how the 2Settle engine settles crypto-to-fiat payouts without duplicates.
Integrating Stripe, Paystack, or USDC checkout? Message me and I'll review your webhook flow.