Best Practices
Responding to webhooks
Quick acknowledgment
Respond with a 2xx status quickly, preferably within a few seconds. Extend times out after 30 seconds.
Asynchronous processing
Queue tasks that are slow, depend on external services, or may need retries.
Handling duplicates and retries
Idempotency with event IDs
Extend tries to minimize duplicate requests, but occasionally they are unavoidable. If your side effects are not idempotent, you can use the eventId (e.g., event_abc123) to avoid processing the same event multiple times.
Error handling and reliability
Retry strategy
Extend retries failed or timed-out (30 s) requests with exponential backoff:
Security considerations
Always verify signatures
Always verify the webhook signature using the SDK’s verifyAndParse() or verify_and_parse() method. This ensures:
- The request actually came from Extend
- The payload hasn’t been tampered with
- The request is recent (protects against replay attacks)
See the signature verification guide for more details.

