Webhook delivery is usually at-least-once rather than exactly-once. A production bot must expect duplicates, delayed events and retries that arrive after the first request already changed state.
Reject requests that fail signature or secret verification before parsing untrusted content further.
Protect state transitions too. Two different events may race to update the same conversation or job.
Monitor queue age, failure rate and processing latency. A webhook endpoint returning success is not proof that the bot completed the user's request.
Acknowledge quickly
Verify the request, store the event and return a successful response before performing slow work. Image processing, AI calls and external API requests belong in a queue where they can be retried independently.Reject requests that fail signature or secret verification before parsing untrusted content further.
Deduplicate by event identity
Store the platform event ID with a uniqueness constraint. If the same delivery arrives again, return success without repeating the action. When the platform provides no stable ID, derive an idempotency key from carefully selected immutable fields.Protect state transitions too. Two different events may race to update the same conversation or job.
Plan for recovery
Use bounded retries with backoff, then move persistent failures to a review queue. Record enough sanitized context to diagnose the event without logging tokens or private message bodies unnecessarily.Monitor queue age, failure rate and processing latency. A webhook endpoint returning success is not proof that the bot completed the user's request.