Node.js

Capture webhook bytes before JSON middleware, select the retained secret by X-Key-Id, verify the v2 HMAC and five-minute timestamp window, then parse JSON. In one database transaction, insert the unique event ID and record an idempotent fulfillment obligation. Perform external shipment from your own outbox after commit.

See Signature Verification for executable TypeScript.