The fix is two parts. Every incoming webhook event has an ID. Before writing anything, check whether you've already processed that ID — a key in your database or cache is enough. If it exists, return 200 and stop. If it doesn't, write it first, then proceed. That way a retry on the same event hits the check and exits cleanly.