Webhooks and callbacks
Receive asynchronous status updates safely and make callback processing reliable, secure, and observable.
# Webhooks and callbacks
Receive asynchronous status updates safely and make callback processing reliable, secure, and observable.
## Design a reliable callback endpoint
Expose a stable HTTPS endpoint that accepts the callback payload, validates it, records the event, and returns a quick success response. Slow work should happen after the event has been persisted.
- Use HTTPS and restrict access where your infrastructure supports it.
- Persist the raw payload, timestamp, and the reference before updating your business record.
- Make processing idempotent because the same callback may be delivered more than once.
## Verify the final state
A callback should be matched to an existing business record using its reference. For high-value actions or an unexpected payload, verify the state with the relevant status endpoint before completing the customer-facing workflow.