Webhook review checklist
Before merging billing route changes, reviewers need a compact way to check signature verification, trusted fields, idempotency, and retry behavior.
Open the free generatorStart with the signature gate
Confirm the route reads the exact raw request body, verifies the provider signature, rejects malformed signatures, and only parses business fields after verification succeeds.
Inspect trusted billing fields
Record the event name, object ID, customer mapping, payment status, amount, and target entitlement record so the reviewer can see which fields drive side effects.
Attach a review report
Include a Markdown report in the pull request or release checklist with the idempotency key, handler decision, and duplicate-retry safety checks.
FAQ
What should a webhook PR reviewer check first?
The signature gate should be first. If raw-body verification is wrong, every downstream billing field is untrusted.
Why attach a webhook review report?
A short report makes the route decision auditable and helps future reviewers understand why an event grants access, renews a subscription, or schedules cancellation.
Use the free sample before wiring production checkout
Download a public sample pack with fake Lemon Squeezy fixtures, signature tests, contract checks, duplicate replay tests, and CI skeletons. The Pro Kit preview shows the full paid package structure without exposing the private archive.