Webhook System for a Site: Receiving, Sending, and Monitoring Events
Consider: when a payment gateway sends a transaction notification, the connection timeout rarely exceeds 10 seconds. If the server fails to return HTTP 200 OK, the provider retries the request, and data may be duplicated or lost. Over five years, we have implemented over 20 webhook integrations with various services: Stripe, GitHub, CRM systems. Every detail — from HMAC verification to a dead letter queue — has been tested across dozens of projects. We know how to avoid synchronous processing, duplicate ignorance, and weak verification.
A naive implementation handles events synchronously, ignores duplicate identifiers, and skips signature verification. The result: double charges, lost orders, silent integration failures. Our approach eliminates these risks at the design stage. Get a consultation — we will assess the complexity of your integrations and propose an architecture that won't fail. Contact us to discuss details.
Why Webhooks over Polling?
| Criteria | Webhook | Polling |
|---|---|---|
| Latency | Instant | Up to polling interval (1–60 s) |
| Server load | Minimal (only on events) | Constant (every request) |
| Risk of missed events | Low (retry, queue) | Possible with large interval |
| Implementation complexity | Medium (verification, idempotency) | Simpler but costlier to operate |
Webhooks are the obvious choice for real-time notifications. They require proper processing: verification, deduplication, and retry. The time and resource savings from using webhooks justify the implementation cost.
How We Implement Secure Webhook Reception
We build the architecture on Laravel with Redis queues. The key point is signature verification before any business logic. Each provider uses its own algorithm:
Stripe / HMAC-SHA256:
$secret = config('services.stripe.webhook_secret'); $sigHeader = $request->header('Stripe-Signature'); $payload = $request->getContent(); list($t, $v1) = parseStripeSignature($sigHeader); $signed = hash_hmac('sha256', "{$t}.{$payload}", $secret); if (!hash_equals($signed, $v1)) { throw new InvalidSignatureException(); } Always use hash_equals — protection against timing attacks. After verification, the job is dispatched to the queue to avoid blocking the response (provider timeout is 3–10 s).
Deduplication: We set job uniqueness for one hour using uniqueFor. In the database, we check external_id and skip duplicates. This eliminates double payment charges or duplicate orders.
What Makes the System Fault-Tolerant?
Outgoing event sending is managed by subscriptions: each request is signed with HMAC, and exponential backoff is applied on errors. After 10 failures, the subscription is automatically deactivated — you receive a Telegram notification. The dead letter queue collects unprocessed jobs, and engineers are alerted.
| Attempt | Delay |
|---|---|
| 1 | 10 s |
| 2 | 30 s |
| 3 | 2 min |
| 4 | 10 min |
| 5+ | 30 min (max 10) |
Exponential backoff with jitter reduces load on the external service and increases delivery success.
What's Included in Turnkey Webhook System Development
- Receiving incoming webhooks: route registration, signature verification, logging, queue dispatching.
- Sending outgoing events: subscription management, signing, retry logic, deactivation.
- Monitoring dashboard: view incoming/outgoing requests, statuses, payload, errors. Optional integration with Laravel Telescope.
- Dead letter queue: unprocessed jobs go to a separate queue with alerts.
- Documentation and training: API description, instructions for your team.
- Warranty: support for one month after launch.
Example typical metrics (based on 20+ projects)
- 99.9% of events are delivered on first attempt after queue implementation. - Average processing time per event — 200 ms (excluding external calls). - Duplicate rate after deduplication — below 0.01%.Process and Timelines
- Analysis — discuss providers, events, security requirements.
- Design — choose queue, signature scheme, table structure.
- Implementation — write code, cover main scenarios with tests.
- Testing — run integration tests, simulate events.
- Deployment and monitoring — deploy on your server, connect alerts.
A basic system (one provider, verification, queue) — from 1 working day. A full platform with subscriptions, dashboard, and retry — 3–5 days. Cost depends on the number of integrations and complexity — contact us, we will prepare an offer.
Common Mistakes in Webhook Implementation
- Synchronous processing — response to client takes more than 10 s, provider considers event undelivered.
- Ignoring duplicates — repeated requests lead to double operations.
- Weak verification — anyone can call your endpoint and forge data.
- Lack of monitoring — errors go unnoticed, subscriptions "hang."
Stripe uses HMAC-SHA256 for signatures — the same approach we apply. Laravel queues provide built-in queues with uniqueness support. These technologies are proven by thousands of projects.
We account for risks at the design stage — this guarantees stable integration operation. Order webhook system development: discuss your project details and we will prepare a proposal.