Checklist — Xano Webhook Endpoint

Webhook Signature Verification

Signature verified before processing any payload
Signature secret stored in Xano Environment Variables — not hardcoded
Request rejected with 401 if signature is invalid
Signature header name known and documented
Timing-safe comparison used for signature verification

Endpoint Configuration and Payload Handling

Endpoint is unauthenticated (no Xano Auth Token check)
Method is POST
URL is unique and not guessable if needed
Payload event type checked before processing
Required fields extracted and validated before use
Idempotency key stored and checked before processing the same event twice

Processing, Response, and Logging

Processing logic separated from signature verification
Business logic uses reusable functions where appropriate
Return 200 quickly — do not do slow blocking operations synchronously
Return 401 for signature failure and 400 for malformed payload
Do not return 500 for business logic failures — return 200 and log internally
Every received webhook logged with timestamp, event type, and event ID
Do not log full payloads if they contain card data or PII

Testing and Done When

Tested with a real payload from the provider's test mode
Valid signature processed and invalid signature rejected
Idempotency tested with duplicate event delivery
Unknown event type ignored gracefully with 200 returned
Endpoint URL registered with the external service