third-party-integration

Verify Stripe webhook signatures by computing HMAC-SHA256 over the timestamp and raw payload using your webhook secret, then comparing with the v1 value in the Stripe-Signature header using hmac.compare_digest. Reject timestamps older than 5 minutes to prevent replay attacks.

Generate a code verifier and SHA-256 challenge, redirect the user to the provider's authorization URL with the challenge and a state token, then exchange the returned code along with the verifier at the token endpoint. Store the state-to-verifier mapping in Redis or the session for validation.

Webhook providers like Stripe guarantee redelivery when they do not receive a 2xx response, so the same event can arrive multiple times. Idempotent handlers check an event ID store before processing and skip already-processed events, preventing duplicate charges or state changes.

Apply client-side throttling by tracking request timestamps and sleeping when the per-second quota is reached. On a 429 response, read the Retry-After header, wait that duration, and retry, while logging X-RateLimit-Remaining to warn before limits are exhausted.

No, return 200 immediately and process the event in a background task. Providers like Stripe retry for up to 3 days if they do not receive a 2xx within 30 seconds, so slow synchronous handlers cause retry storms and duplicate deliveries.