Webhooks done right: retries, signatures, and idempotency

Oct 20, 2025 #backend #async

The three properties that separate webhooks that just work from ones you fear.

There is a version of this article that opens with theory. I decided against it, because the theory is easy to find and the motivation is not — so let's start with the thing that actually broke.

Context

What surprised me most was how small the final change was. Most of the work was understanding the problem precisely enough that the fix became obvious, and that understanding took far longer than the fix itself.

The plan

By the end of this post you should be able to reproduce the whole thing yourself in under an hour, including the parts I got wrong the first time — those are marked so you can skip them if you're in a hurry.

I kept a log of every decision during this project, and reading it back a month later was humbling: the choices that aged well were the boring ones, and the clever ones all came with a footnote I hadn't written yet.

A note for context that helps the reader.

fn retry<T>(mut f: impl FnMut() -> Result<T>, times: u32) -> Result<T> {
    let mut last = None;
    for _ in 0..times {
        match f() {
            Ok(v) => return Ok(v),
            Err(e) => last = Some(e),
        }
    }
    Err(last.unwrap())
}

What shipped

The first version worked, which is exactly why it was hard to see how wrong it was. Everything looked fine in the demo, and everything looked fine until traffic arrived on a Tuesday afternoon and the graph started doing something I'd never seen before.

The best engineering advice I've received is unglamorous: make it measurable, make it reversible, and only then make it fast.

Follow-ups

The numbers below are from my own machine and my own workload. Treat them as a method, not a benchmark: the point is how the measurement was taken, not the exact figures it produced.

Approach	Best for	Watch out for
Baseline	Quick comparisons	No tail visibility
Instrumented	Finding the real hotspot	Overhead of the probes
Production	Truthful numbers	Harder to reproduce

Context

There is a version of this article that opens with theory. I decided against it, because the theory is easy to find and the motivation is not — so let's start with the thing that actually broke.

A note for context that helps the reader.

The plan

The numbers below are from my own machine and my own workload. Treat them as a method, not a benchmark: the point is how the measurement was taken, not the exact figures it produced.

[deploy]
strategy = "rolling"
healthcheck = "/healthz"
max_unavailable = 1

What shipped

I want to be honest about the trade-offs here. The approach I settled on solves the problem I had, not every problem of this shape, and there is a clear point where you should reach for something more heavy-duty.

Tools matter less than the feedback loop they enable. A fast, boring loop beat every sophisticated setup I tried, and I've kept it ever since, even as the rest of the stack changed twice over.

Read the error message twice before changing anything
Reproduce it with the smallest input you can
Write the failing test first, even if it feels ceremonial
Only then reach for the fix

Follow-ups

There is a version of this article that opens with theory. I decided against it, because the theory is easy to find and the motivation is not — so let's start with the thing that actually broke.

The numbers below are from my own machine and my own workload. Treat them as a method, not a benchmark: the point is how the measurement was taken, not the exact figures it produced.

Wrap-up

If you remember one thing, make it this: the three properties that separate webhooks that just work from ones you fear compounds. The cost of getting it right early is a afternoon; the cost of getting it late is a migration.