API preview
Verification
Webhook deliveries should be cryptographically signed using a documented method. Consumers must verify the signature before trusting a payload and must support secret rotation.
Delivery semantics
Webhook consumers should assume an event can be delayed, retried or delivered more than once. Handlers should process event identifiers idempotently and avoid treating delivery order as guaranteed unless an event type explicitly documents that behavior.