Webhooks

Delivery, duplication, ordering and verification of provider notifications.

Projects

PandaPayLens

An open-source, local-first toolkit that decodes payment provider errors, webhooks and event logs, rebuilds the transaction timeline and explains what looks wrong, without sending the data anywhere.

When a payment integration misbehaves, the evidence is a pile of provider-specific JSON, XML and webhook deliveries. Reading it means knowing each provider's formats, error codes and delivery habits, and the data is often too sensitive to paste into an online tool.

Read the case study Source Live demo npm

Status: Active
Type: Developer tool
Role: Creator and maintainer
Technology: TypeScript, Next.js, React

Problem records

A refund delivered twice looked like two refunds
Providers that send notifications without a delivery id defeated duplicate detection, so a repeated refund notification could be read as refunds exceeding the payment.
ResolvedPandaPayLens25 Oct 2026
The timeline showed late payment steps first
Events without a timestamp were sorted after every timed event, so a Paystack flow appeared with the webhook and verification before the PIN and OTP steps.
ResolvedPandaPayLens25 Oct 2026

Journal

Twelve payment and webhook code reviews: the bugs that keep coming back
In October 2026 I reviewed twelve pull requests in Stripe, PayPal, Razorpay, Adyen, Payload, Medusa, Better Auth, Svix, Standard Webhooks, n8n and Hyperswitch code. Most findings fall into five patterns.
Code review26 Oct 2026
Stripe webhook ordering in Better Auth: how a retry can drop onTrialEnd
Refetching the subscription is the right fix for Stripe snapshot events. Deriving lifecycle callbacks from the event while guarding them with the stored row meant a retried event could skip onTrialEnd, onTrialExpired and onSubscriptionCancel.
Code review26 Oct 2026
HMAC signs bytes, not text: binary webhook payloads in Standard Webhooks
The JavaScript and Python Standard Webhooks libraries decoded the body as text before signing it, so gzip, protobuf or image payloads could not be verified. The fix is right; the review is about the inputs it now accepts silently.
Code review26 Oct 2026
Constant-time webhook signatures in razorpay-node: when the fix accepts more than the bug did
A pull request replaced === with crypto.timingSafeEqual in razorpay-node. Decoding the signature as hex made the check accept upper-case, truncated and padded signatures, and the new tests never ran.
Code review26 Oct 2026
Case-insensitive webhook headers in the Svix PHP and Ruby SDKs, and the PSR-7 array trap
A Svix fix lets verify() find Svix-Id as well as svix-id. With PSR-7 headers the keys now match but the values are arrays, and intval turns the timestamp into 1.
Code review26 Oct 2026
Signing Mailchimp webhooks in n8n: key rotation and the workflows that never get a secret
n8n adds X-Mailchimp-Signature verification to its Mailchimp trigger. Two non-blocking points: keep every v1 signature for rotation, and existing workflows silently stay unverified.
Code review26 Oct 2026