# Webhooks
Source: https://nordvec.com/docs/guides/webhooks#best-practices

## Best practices [#best-practices]

- **Deduplicate on `webhook-id`.** Automatic retries, resends and replays
  reuse the same id, so
  storing processed ids gives you exactly-once processing on top of
  at-least-once delivery.
- **Never treat a payload as current state.** Payloads are thin and can arrive
  late; use the event as a trigger and read the current state from the API.
- **Do not rely on ordering.** Retries and parallel delivery mean events can
  arrive out of order.
- **Return 2xx before heavy work.** Queue the event and process it
  asynchronously; a handler that does its work inline risks hitting the
  10-second timeout and being retried, which turns one event into several
  duplicate attempts.
- **Rotate secrets with a grace window.** A grace period keeps the previous
  secret valid while deliveries are signed with both, so a rolling deploy of
  your services never drops a delivery. For a secret that may have leaked,
  rotate with no grace period instead, as the section on rotating the signing
  secret above describes.