Treat webhooks as notifications
Use a webhook to learn that state changed, then read the current job resource. Your integration should tolerate duplicates and out-of-order delivery.
Verify and rotate
- Validate webhook signatures.
- Use HTTPS.
- Return success quickly, then process asynchronously.
- Rotate the webhook secret after suspected exposure.
Recover
Reconcile from the jobs API or event stream after downtime instead of assuming every webhook arrived exactly once.