One Webhook, Five Deliveries, One Entitlement

Short summary

A technical guide to preventing duplicate entitlement grants from repeated webhook deliveries, using a deliberately vulnerable example and its fix. The article distinguishes signature verification (authenticity) from idempotency (novelty) and shows how a stable event key plus an entitlement key ensure one webhook creates exactly one grant. It includes a reproducible test that sends the same signed webhook five times and verifies only one entitlement is created.

• •Signature verification proves authenticity but not idempotency — repeated deliveries still grant access
• •A stable event key (eventName:orderType:orderId) deduplicates repeated accepted events
• •Test by replaying one signed webhook five times and verifying exactly one entitlement grant

Generated with AI, which can make mistakes.