Webhook Handling with Claude Code: Signature Verification, Idempotency, and Retry Safety

Incoming webhooks from Stripe, GitHub, or any provider need three things: signature verification, idempotency protection, and fast responses. Get any of these wrong and you have security holes or double-processed payments. Claude Code generates the complete safe implementation. CLAUDE.md for Webhook Handling ## Webhook Receiving Rules ### Security (required) - Verify signatures on ALL incoming webhooks (reject without valid signature) - Stripe: verify stripe-signature header with Webhook Secret - GitHub: verify X-Hub-Signature-256 with HMAC-SHA256 - CRITICAL: verify against rawBody (not parsed JSON — parsing changes the bytes) ### Idempotency (required) - All webhook handlers must be idempotent (safe to receive same event twice) - Idempotency key: {provider}-{eventId} in DB processed events table - Already-processed events: return 200 immediately, skip processing ### Response timing - Return 200 within 5 seconds (providers retry if no response) - Heavy processing goes to BullMQ queue B