Protect Webhooks

Use HTTPS for the production target URL and make sure the certificate is valid.
The server verifies the Authorization Bearer Token, and then processes the Payload after the verification is successful.
Use Delivery ID or Request ID as an idempotent key to avoid repeated issuance of coupons, deductions or modification of account status.
Complete authentication and basic verification first, then put time-consuming business into asynchronous processing; return HTTP response as soon as possible.
Do not record the complete Token, complete Payload or unnecessary device and network information in the log.
Delivery logs and Response Body are only available to administrators, developers, and operation and maintenance personnel in need.