You should set a webhook secret for your webhook and verify that the signature of each webhook delivery matches the secret. This helps to ensure that the webhook delivery is from Shopwaive. For more information, see "Validating webhook deliveries."
The webhook secret should be a random string of text with high entropy. You should securely store your webhook secret in a way that your server can access.
Your server should respond with a 2XX response within 10 seconds of receiving a webhook delivery. If your server takes longer than that to respond, then Shopwaive terminates the connection and considers the delivery a failure.
In order to respond in a timely manner, you may want to set up a queue to process webhook payloads asynchronously. Your server can respond when it receives the webhook, and then process the payload in the background without blocking future webhook deliveries. For example, you can use services like Hookdeck or libraries like Resque (Ruby), RQ (Python), or RabbitMQ (Java).
There are multiple webhook event types, and many events can have multiple action types. Shopwaive continues to add new event types and new actions to existing event types. Your application should check the event type and action of a webhook payload before processing the payload. To determine the event type, you can use the X-Shopwaive-Event request header. To determine the action type, you can use the top-level action key in the event payload.