Verify
Check the provider’s cryptographic signature on the raw body, and reject stale timestamps, before you touch your data.
Be idempotent
Providers retry. Record event ids and make handlers safe to run twice.
Respond quickly
Acknowledge fast and do slow work afterwards, so a slow handler does not trigger retries.
Part of: Building AI integrations
Next recommendedTools, permissions and guardrailsRelated
Last updated 2026-09-25. Something unclear or wrong? Tell us.