recur-webhooks

You verify Recur webhook signatures by computing HMAC-SHA256 over the Base64-encoded payload and comparing it against the signature header. This confirms the request originated from Recur before processing payment events.

Handle duplicate Recur webhook deliveries by implementing idempotent event processing. Store processed event IDs and check them before executing business logic, preventing duplicate entitlement changes for subscription.activated or subscription.renewed events.

You need to handle checkout.completed, subscription.activated, subscription.cancelled, subscription.renewed, subscription.past_due, order.paid, and refund.created events to manage entitlement states across your React frontend and FastAPI backend.

Yes, the webhook integration routes events to appropriate business logic across FastAPI backends and React frontends. It provides a robust endpoint, signature validation utilities, and payload schemas for managing entitlement changes.

You test Recur webhook validation and idempotency by starting the webhook listener and sending a test event. The implementation includes testing guidance for verifying signature validation and deduplication handling in local and staging environments.

Idempotent event handling for payment webhooks prevents duplicate actions when Recur retries failed deliveries. Without deduplication, processing the same checkout.completed or order.paid event twice can corrupt subscription entitlements and cause billing errors.