Compatible with Cursor, Claude Code, Cline, Roo Code, Antigravity

Idempotent Webhook Handler & Background Queue Processor

Implement production-grade third-party webhook receivers with cryptographic verification and background processing.

WebhooksStripeSecurityQueuesBackend

v1.0.0 · Updated 2026-08

Skill Objective

Implement secure webhook ingest endpoints (e.g. Stripe, GitHub, Shopify) that verify signatures, return immediate 200 OK responses, and queue work for background workers.

Execution Workflow Procedure

Ordered steps the coding agent executes when performing this skill.

Verify Webhook Cryptographic Signatures

Validate HMAC signatures using raw request bodies and timing-safe comparison before parsing JSON.

Fast Acknowledgment & Enqueueing

Store incoming event payloads in an idempotent queue and immediately return HTTP 200 OK to prevent provider timeouts.

Idempotent Background Worker Processing

Process events in background workers, checking idempotency keys inside database transactions.

Agent Safety Guardrails & Anti-Hallucination Rules

DO NOT execute slow database transactions or email dispatch inside the synchronous webhook HTTP handler.
DO NOT use parsed JSON bodies for HMAC signature validation; always verify against raw request buffers.

Expected Output Format

Secure ingress route and idempotent background worker.

🛡️ Webhook Ingress Route: Signature validation and fast ack.

⚙️ Background Worker Handler: Idempotent business logic execution.

Domain Verification Checks

Raw Buffer Signature: Verifies HMAC signature on raw unparsed request bytes.

Fast 200 Response: Acknowledges receipt in < 50ms before heavy computation.

Idempotent Processing: Prevents duplicate fulfillment on retried webhooks.

Example Agent Invocations

"Implement a secure Stripe webhook receiver for invoice.payment_succeeded and customer.subscription.deleted."

"Build a GitHub webhook handler that queues CI check events for processing."

Install / Configure This Skill

# Place in .cursorrules or create .cursor/rules/idempotent-webhook-queue-processor.mdc
# Trigger: Whenever you perform idempotent webhook handler & background queue processor

---
name: idempotent-webhook-queue-processor
description: Implement secure, idempotent third-party webhook receivers with signature verification and background queue workers.
version: 1.0.0
compatibility: [Cursor, Claude Code, Cline, Roo Code, Antigravity]
---

# Idempotent Webhook Handler & Background Queue Processor

## Objective
Safely ingest third-party webhooks with cryptographic HMAC signature verification and decoupled background worker processing.

## Workflow
1. **Signature Verification**: Validate HMAC signatures on raw request buffers using timing-safe comparisons.
2. **Immediate Acknowledgment**: Return HTTP 200 OK immediately and enqueue the event.
3. **Idempotent Worker**: Process events in background jobs checking for duplicate event IDs in database transactions.

Complementary Agent Prompt

Need a quick one-time prompt for chat?

Try the Pull Request Severity-Graded Code Review — a lightweight version designed for 1-click copying directly into Claude, ChatGPT, or Cursor chat.

View Prompt