Verify webhook origin

Verify Bearer Token

Save a Token consistent with the console configuration on the server side and perform verification on each callback. When the verification fails, do not continue to process the payload, and do not return detailed errors that will reveal the reason for the internal verification.

Use HTTPS

Production target URLs must use HTTPS and ensure:

• The certificate is valid and has not expired.
• The domain name certificate matches the target domain name.
• The server supports the TLS version used by Geelab.
• The certificate chain can be verified normally by public network services.

Safely save and rotate tokens

Token should be saved in the server environment variable or key management system. The current product Token regeneration and rotation method is subject to the operations provided on the Webhooks page.

If the Token is leaked:

1. Immediately limit or suspend the affected webhook.
2. Update the server verification configuration.
3. Update or regenerate the Token in the console (if the page provides this operation).
4. Send a test request to verify the new configuration.
5. Check the delivery log for abnormal requests.

Prevent duplicate processing

To prevent the same event from repeatedly affecting the business, it is recommended to use Delivery ID or Request ID to implement idempotent processing:

• Record unique identification and process when first received.
• Return success when receiving the same logo again, but do not repeat operations such as issuing coupons, deducting money, or banning.
• Write processing state to reliable storage instead of just keeping it in process memory.