creating-webhook-handlers

# Creating Webhook Handlers ## Overview Create secure webhook receiver endpoints with HMAC signature verification, idempotent event processing, and automatic retry handling. Support ingestion from providers like Stripe, GitHub, Twilio, and Slack with provider-specific signature validation schemes and payload parsing. ## Prerequisites - Web framework with raw body access (Express with `express.raw()`, FastAPI with `Request.body()`) - Webhook provider credentials: signing secret or shared secret key - Persistent storage for idempotency tracking (Redis or database table for processed event IDs) - Queue system for async processing (optional: Bull, Celery, SQS) - ngrok or similar tunnel for local development testing ## Instructions 1. Examine existing route definitions and middleware using Grep and Read to identify where webhook endpoints integrate into the application. 2. Create a dedicated webhook route (e.g., `POST /webhooks/:provider`) that captures the raw request body before any JSON parsing middleware runs. 3. Implement HMAC-SHA256 signature verification by computing `HMAC(raw_body, signing_secret)` and comparing against the provider's signature header (`X-Hub-Signature-256`, `Stripe-Signature`, `X-Twilio-Signature`). 4. Add idempotency protection by storing processed event IDs (e.g., `evt_xxx`) in Redis or a database table, rejecting duplicates with 200 OK to prevent provider retries. 5. Parse the event type from the payload (`event.type`, `action`, `EventType`) and ...