Consumers, producers and trust

Inverting the call

A webhook is an API call made by the provider to your server for event notification. The roles invert: the provider becomes the client, your endpoint becomes the server, and concerns apply in reverse. This shift in perspective is crucial for building reliable integrations that don't crumble under production pressure. You are now the one who must provide high availability and fast response times to ub3r.

The threat model

Your endpoint is a public URL on the open internet that anyone can discover. Anyone who finds it can POST to it, potentially causing harm to your internal systems. Without verification, an attacker can forge delivered events or mark invoices as paid in your database. Treat every inbound request as hostile until its signature proves otherwise through rigorous cryptographic verification.

The responsibilities

The producer must sign every payload, include a timestamp, and retry failed deliveries with backoff. On the other hand, the consumer must verify signatures, reject stale timestamps, and respond quickly. This division of labor ensures that both parties can trust the data being exchanged at all times. It also prevents one side's failure from causing a cascading outage across the entire messaging system.

{
  "event_id": "evt_12345",
  "created_at": "2026-08-18T10:00:00Z",
  "type": "message.delivered",
  "data": { "message_id": "msg_98765" }
}

Building for resilience

Respond within a few seconds to avoid triggering the producer's timeout logic unnecessarily. Do the real work, such as database writes, on an asynchronous queue to maintain performance. A consumer that performs heavy processing inline will eventually time out under high load, triggering retries. By decoupling receipt from processing, you ensure that your webhook endpoint remains highly available for ub3r.

Monitoring Webhook Health

Track the latency and success rate of your webhook endpoint to ensure it stays within SLAs. Use tools like Prometheus or Datadog to visualize these metrics and set up alerts for anomalies. High latency can lead to backlogs in the producer's delivery queue, which delays your business logic. Proactive monitoring helps you catch and fix issues before they impact your end users or customers.