Expose the webhook only over HTTPS and use the provider’s documented request-verification method.
Processing pattern
- Verify signature/authentication.
- Parse the event defensively.
- Record the provider event ID.
- Deduplicate retries.
- Queue expensive processing.
- Return a success response promptly.
- Correlate the provider message ID with your internal send ID.
Do not trust a JSON field saying delivered merely because somebody can POST it to your endpoint.
Keep webhook secrets out of source control and design rotation before production.