An incoming message arrives from outside your application. Even when it is a legitimate provider event, its body is not an instruction to grant access, change an account or invoke every tool an assistant can reach.
Follow the actual signing contract
Use the provider’s documented signature method and the exact representation it requires. messages.dev describes HMAC-signed webhooks and SDK verification; Blooio says signing and retries vary by environment and endpoint availability. Those descriptions are not interchangeable.
Verify the boundary before interpreting customer content. Keep secrets scoped to the integration and avoid recording them in logs. Check documented timestamp and replay rules where supplied. An endpoint that parses JSON successfully has not thereby authenticated its sender.
Retain enough to process safely
Store a stable event identifier when available, the relevant provider references and the observation time. Decide how repeated deliveries are recognized. Separate accepting the event from performing a downstream business action, particularly when that action sends another message or changes a customer record.
Acknowledge according to the documented provider contract after the event is retained sufficiently for your architecture. Do not perform unlimited slow work on the receiving request merely because it is convenient. Build a bounded processing and recovery path appropriate to the provider’s retry behavior.
Test the cases a demo omits
Feed a repeated event, an invalid signature, an unsupported attachment and a late reply into a controlled test. Confirm that your system records the intended outcome and that duplicate delivery does not repeat an irreversible action.
Sendblue’s free sandbox does not expose callbacks and webhooks, so a request-only sandbox test cannot validate that pipeline. Use an environment that actually delivers the events you need. These are suggested acceptance cases, not provider tests performed by Packet Ten.