Endpoint requirements
Your webhook URL must be publicly reachable over HTTPS and should return a successful2xx response quickly. Process heavier work asynchronously after acknowledging the request.
Security checklist
- Use HTTPS.
- Verify the event signature when one is provided.
- Reject unknown event types safely.
- Store the event ID and make processing idempotent.
- Return
2xxonly after the payload has been accepted.
