Your website accepts an enquiry and sends an event to a CRM integration. The first demonstration works. Production introduces retries, delayed deliveries, and events that arrive in an unexpected order.

A reliable receiver needs a processing contract, not just a public URL.

Establish what the sender guarantees

Read the sender's current documentation for signatures, delivery identifiers, timeout limits, retries, and ordering. Do not copy one provider's behavior into another integration.

Record which event types you accept and the schema version you support. Unknown event types should not trigger arbitrary business actions.

Verify before processing

Use HTTPS and the sender's documented authentication mechanism. Where signatures are used, verify the required raw request bytes before modifying or reserializing them. Apply timestamp and replay checks according to that mechanism.

A secret-looking endpoint URL is not a replacement for verification.…