Receive and process webhooks safely

Prompt that plans a webhook receiver with signature check, a quick response and protection against duplicate events. Paste it into an AI tool of your choice, which then plans the webhook receiver.

Topic: Apps & prototypes
Type: Prompt
Level: Intermediate
Time: about 10 min

Results depend on the tool, the model and what you enter.

Result preview

Example: written by our editors, not real AI output.

POST /webhooks/payments 1. Verify the signature over the raw body; timestamp older than 5 minutes → 400 2. Event ID already in the webhook_events table → 200 straight away, do nothing 3. Store the entry (ID, type, received, status "open") → 200 in under 1 second 4. Queue: fetch the current payment state from the provider, unlock the order 5. Error → up to 5 retries with growing gaps, then status "failed" and an alert Tests: wrong signature, same event twice, "refunded" before "paid", database unreachable Assumption: the sender retries deliveries for up to three days

Fill in

What you type stays in this browser window. We store and send nothing.

EventsWhich events arrive?

ProcessingWhat should happen next?

StackWhat do you work with?

Your prompt

Plan a receiver for webhooks.
Sender and events: [Events]
What should happen next: [Processing]
Stack: [Stack]
Approach: 1. Verify the signature of every request with the shared secret over the unmodified raw body, and reject timestamps that are too old. 2. Answer with success immediately and process the event afterwards through a queue. 3. Store the event ID and skip events that have already been processed. 4. Describe how out-of-order events are handled, for example by fetching the current state from the sender. 5. Define what happens on errors: retries, a store for failed events, an alert. 6. List tests for a wrong signature, a duplicate delivery and a processing outage.
Output: the flow as a numbered list, fields for the event log and test cases. Mark assumptions about the sender as assumptions.

Take particular care to trust no incoming request unchecked and let every event take effect exactly once.

Before you answer, check: Are all instructions met? If key information is missing or a placeholder in square brackets is still in the text, ask instead of guessing. Mark assumptions as assumptions.

Plan a receiver for webhooks.
Sender and events: [Events]
What should happen next: [Processing]
Stack: [Stack]
Approach: 1. Verify the signature of every request with the shared secret over the unmodified raw body, and reject timestamps that are too old. 2. Answer with success immediately and process the event afterwards through a queue. 3. Store the event ID and skip events that have already been processed. 4. Describe how out-of-order events are handled, for example by fetching the current state from the sender. 5. Define what happens on errors: retries, a store for failed events, an alert. 6. List tests for a wrong signature, a duplicate delivery and a processing outage.
Output: the flow as a numbered list, fields for the event log and test cases. Mark assumptions about the sender as assumptions.

Take particular care to trust no incoming request unchecked and let every event take effect exactly once.

Before you answer, check: Are all instructions met? If key information is missing or a placeholder in square brackets is still in the text, ask instead of guessing. Mark assumptions as assumptions.

This is an instruction for an AI, not the result itself.

Where this prompt works

These AI tools are a good fit for this prompt:

How to use it

Fill in the fields or tap a suggestion. Leave out names, addresses and other personal data.
Copy the finished prompt into an AI tool of your choice.
Send the same test event twice and one with altered content. The first may take effect only once, the second must be rejected.

Why does this work?

Senders often deliver webhooks more than once, late or out of order. Keeping signature check, event ID and the quick response cleanly separate prevents double bookings and lost events.

Tips

Do not keep the secret in the code; store it in a protected environment variable and plan how to rotate it.

You may use our prompts freely, including at work. Please do not republish them as your own collection. We give no warranty for AI results; check them yourself. Terms of use

Receive and process webhooks safely

Result preview

Fill in

Your prompt

Where this prompt works

How to use it

Why does this work?

Tips

Also a good fit

Choose pagination for an API list New

Write an API reference people can use right away New

Plan a throttled data backfill New