Assign authoritative sources
For example, CRM owns contacts and deal stages while accounting owns payments and inventory. Specify direction and conflict resolution for every shared field. Use stable identifiers rather than customer names. Verify API limits, token scopes and the availability of a sandbox with the provider.
Expect repeated delivery
A webhook may arrive twice or out of order. Its handler should recognise an accepted event without creating another deal. Use bounded retries and a queue for temporary failures, and send permanent errors for investigation. Record event identifiers and processing outcomes without logging secrets or complete personal records.
Test the entire lifecycle
Cover creation, updates, cancellation, deletion and relationship restoration. Test expired access, unavailable APIs, incomplete records and response changes. Give an operator a clear view of delayed events and a safe replay mechanism. Periodic reconciliation catches discrepancies that a health endpoint cannot detect.
Checklist
- Assign field ownership and exchange direction.
- Make event replay safe.
- Exclude secrets from logs.
- Provide reconciliation and controlled reprocessing.
Project questions
Are webhooks sufficient on their own?
Not always. Periodic reconciliation is useful when events can be lost, delayed or delivered while the receiver is unavailable.