HardExperience level: 8-15 years1 min read

How do you design reliable, secure webhooks for event delivery?

Reviewed by Gurusankar M.

Asked inAmazonMicrosoftStripe-likeDeloitte
#webhooks#delivery guarantees#signing#retries#idempotency
Report issue

Short Answer

Deliver events via signed POSTs (HMAC signature header) so receivers can verify authenticity. Use at-least-once delivery with retries + exponential backoff, include a unique event id so receivers dedupe (idempotent processing), and provide a way to replay missed events. Return 2xx fast; process async.

On this page

Concept Made Simple

Coffee Chat Question

“How do you design reliable, secure webhooks for event delivery?”

Remember It Faster

Mind Map Answer

Authenticity
HMAC signature header + secret
Delivery
at-least-once + retry/backoff
Dedup
unique event id → idempotent receiver
Receiver
ack 2xx fast, process async

Think Beyond the Expected

What If?

Why must a webhook receiver be idempotent even if the sender 'tries once'?

Networks make exactly-once impossible: a receiver might process an event, then its 2xx ack is lost, so the sender retries and delivers the same event again. The receiver must dedupe on the event id and process idempotently — otherwise retries cause duplicate side effects (double order, double email).

Real World

Stripe/GitHub webhooks sign payloads (HMAC), retry with backoff, and send a unique event id precisely so consumers can verify and dedupe; consumers that aren't idempotent get duplicate-processing bugs.

Interviewer's Expectation

Keywords they're listening for:

  • HMAC signing/verification
  • at-least-once + retries/backoff
  • unique event id + idempotent receiver
  • fast 2xx ack + async processing
  • replay

Common Mistakes

  • Unsigned webhooks (spoofable)
  • Non-idempotent receivers (duplicate side effects)
  • Doing heavy work before acking (timeouts → retries)

Best Practices

  • Sign payloads (HMAC) and verify on receipt
  • Ack 2xx fast; process async; dedupe by event id
  • Retry with backoff; offer replay

Follow-up Questions

  1. How does HMAC signature verification work?
  2. Why ack quickly and process asynchronously?
  3. How do you let consumers replay missed events?

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: Idempotency (REST APIs)
Interview question: "How do you design reliable, secure webhooks for event delivery?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Affiliate links

Tools for Your Developer Workspace

Equipment for a comfortable, productive setup.

As an Amazon Associate I earn from qualifying purchases.