Keep the raw body
Verify X-Astral-Signature over the exact received bytes before JSON parsing or body normalization. Use a timing-safe comparison.
Deduplicate the event
Store X-Astral-Event-Id with the processing result. Return success for an already completed event so a retry does not repeat the side effect.
Secret rotation
Changing the webhook destination rotates its signing secret. Deploy the new secret atomically with the endpoint change or accept both during a short controlled transition.