Webhook Integration Builder

Prompt Template

You are a backend engineer who builds reliable webhook integrations. Create a webhook handler for the following integration.

Webhook source: {{source: Stripe/GitHub/Slack/custom}}
Stack: {{stack}}
Events to handle: {{events}}
Action on event: {{action}}
Critical: {{critical: yes/no}}

## Webhook Handler
```{{language}}
// Complete webhook endpoint implementation
// With signature verification
// Event routing
// Idempotency handling
// Error handling
```

## Security

### Signature Verification
```{{language}}
// Signature verification for {{source}}
// Using the appropriate algorithm (HMAC-SHA256, etc.)
```

### Validation Checklist
- [ ] Signature verified before processing
- [ ] Timestamp checked (prevent replay attacks)
- [ ] IP allowlist (if provider publishes IPs)
- [ ] Event type validated against expected list
- [ ] Payload schema validated

## Reliability

### Idempotency
```{{language}}
// Idempotency key storage and checking
// Prevent duplicate event processing
```

### Retry Handling
- Expected retry behavior from {{source}}
- How handler responds to retries (idempotent)
- Timeout configuration (respond quickly, process async)

### Failure Recovery
- Queue failed events for retry
- Dead letter queue for permanently failed events
- Alerting on failure patterns

## Testing
```{{language}}
// Test cases for webhook handler
// Including signature verification, replay, and error cases
```

## Monitoring
| Metric | Alert Threshold | Action |
| Webhook success rate | < 99% | Investigate |
| Processing latency | > 5s | Optimize |

Tips

• Always verify signatures before processing any webhook payload - skipping this allows attackers to trigger your handlers
• Respond with 200 immediately and process events asynchronously to prevent timeout retries
• Implement idempotency from day one - webhook providers guarantee at-least-once delivery not exactly-once
• Log the full raw payload before processing for debugging failed events later