The framing of a webhook as “a message from a queue you do not own” is the useful mental model. Once you make that shift, signature verification, idempotency, ordering, and retry handling stop looking like separate security checklist items and become properties of the same consumer design.

One detail I’d emphasize is making the acknowledgement boundary explicit: after authentication and an atomic event claim, persist the event durably before returning 2xx. From there, the provider is no longer part of your processing reliability loop. Your own queue, idempotency state, retry policy, and dead-letter handling become the controls you can actually reason about and test under failure.