The first webhook bug I shipped looked harmless: a payment provider retried an event after my endpoint took too long to answer, and the same order got marked as "paid" twice. Nothing crashed. The logs were green. The accountants found it three weeks later.

Webhooks are the most common integration pattern in business software. Payment providers, shipping companies, e-invoicing gateways, CRMs and marketplaces all push events to you instead of waiting for you to poll. And almost every webhook endpoint I have reviewed has the same three holes: it trusts the caller, it accepts old messages, and it assumes each event arrives exactly once.

This article walks through a small, production-shaped webhook receiver in Laravel that closes all three.

The problem: a public URL that changes your data

A webhook endpoint is a public POST route that, by design, modifies business records without a logged-in user.…