Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteYes. Payment providers may deliver the same webhook more than once, so your handler must make business effects safe to repeat. Store and atomically claim each event before processing it; then make downstream actions—such as fulfillment, account credits, and ledger updates—idempotent too. A duplicate webhook is a delivery condition, not proof that the customer was charged twice.
Why payment webhooks can be duplicates
Webhook delivery has to cope with network failures and missed acknowledgements. If a provider cannot confirm that your endpoint accepted an event, it may retry delivery. Your server might have completed its work but failed to return a response in time, or the response might have been lost. The retry can therefore reach an endpoint that has already acted on the event.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
APIs and Webhooks for Beginners: Connect Apps, Automate Tasks, and Build Useful Integrations | $2.99 | Buy on Amazon |
| 2 |
|
Shelly Pro 3EM 3CT 63 Wi-Fi & LAN 3-Phase Smart Energy Meter | $150.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
This is an expected condition in provider documentation: Stripe says an endpoint may receive the same event more than once; PayPal’s invoicing guide describes at-least-once delivery; and Adyen warns that the same webhook event can arrive twice. None of those facts means a payment was captured twice. It means your application must distinguish repeated delivery from a new business operation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
There are three cases to keep separate:
- The same event is retransmitted. Treat it as already accepted or processed using the provider’s event identity.
- Different events describe related or repeated state. Decide whether each event represents a distinct change or whether your business effect should occur only once for an underlying object and event type.
- Your application retries an outbound payment request. This is not inbound webhook deduplication; it calls for the payment API’s request-idempotency mechanism where supported.
Choose a deduplication identity that matches the provider
Do not assume every provider uses the same key, or that one event ID handles every kind of duplicate. Follow the provider’s event model and define the identity for the business effect you need to protect.
#1 Best Overall
| Provider | Identity or duplicate guidance | Delivery and ordering details documented in the cited guide |
|---|---|---|
| Stripe | Track the Event ID for repeated delivery of the same Event. Stripe also notes that separate Event objects can sometimes represent duplicates; for those, it recommends considering the object ID in data.object together with event.type. |
In live mode, automatic retries continue for up to three days with exponential backoff. Manual resends are available from the Dashboard for up to 15 days and the CLI for up to 30 days. Stripe does not guarantee event order. Stripe webhook documentation. |
| Adyen | Notifications with the same eventCode and pspReference can be duplicates even if eventDate or other fields differ. Use the latest webhook event details. |
The handling guide says a webhook is placed in a retry queue if a response is not received within 10 seconds. Some webhook types include a sequenceNumber; check timestamps and sequence information when applying state changes. Adyen webhook handling documentation. |
| PayPal | The invoicing webhook guide identifies the event id as a unique identifier to use for deduplication. |
The invoicing guide describes at-least-once delivery. Separately, PayPal’s general REST integration guide says unsuccessful deliveries may be retried up to 25 times over three days. That retry policy is documented for the REST integration guide; do not assume it applies identically to every PayPal product. PayPal invoicing webhook guide and PayPal REST webhook integration guide. |
For Stripe, deduplicating solely by Event ID covers retransmission of that Event, but may not suppress separate Event objects representing the same underlying action. Conversely, deduplicating every event by object ID alone can hide legitimate changes to that object. Choose a compound identity only when it reflects the business action you intend to run once.
Build a handler that cannot race itself
A check-then-act pattern is unsafe on its own: two deliveries can arrive at the same time, both check that an event is absent, and both perform the side effect. Make the claim atomic, typically with a database uniqueness constraint or equivalent atomic store.
- Receive and verify. Read the request in the format required by the provider and validate its signature before trusting event data or triggering business actions. Preserve the raw request body if the provider’s signature method requires it.
- Derive the provider-specific identity. Select the event ID or other documented identity appropriate to the duplicate case and business effect.
- Persist an inbox record atomically. Store the event under a uniqueness constraint scoped to the provider and, where relevant, merchant account. Include fields useful for recovery, such as event type, receipt time, and processing status.
- Accept work durably before acknowledging. In the same transaction, or through a recoverable inbox/outbox design, record the work or enqueue it durably. A crash after a success response must not leave an event with no way to resume processing.
- Acknowledge according to the provider contract. Return the required success response promptly after durable acceptance. Do not use one provider’s timeout or status-code rule as a universal webhook standard.
- Process asynchronously and record the outcome. Let a worker apply the business change, then mark the record complete or failed with enough detail to retry safely and investigate.
- Protect downstream side effects too. If processing calls another service or sends a credit, use that system’s idempotency or a durable local operation record. Deduplicating the webhook alone cannot prevent a worker retry from repeating an external action.
This inbox pattern is engineering guidance based on the providers’ documented duplicate and acknowledgement behavior, not a mandatory schema shared by all providers. Adyen specifically recommends verifying the webhook, storing it in a database or queue, acknowledging it, and then handling business logic. Its guide identifies a 10-second acknowledgement threshold for that flow. Stripe likewise recommends verifying signatures, responding promptly, and deferring complex work.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Do not confuse webhook deduplication with API idempotency
An outbound idempotency key protects a request your application sends to a payment API—for example, retrying a payment-creation POST without repeating that API operation. Inbound deduplication protects your webhook consumer when the provider delivers an event again. You may need both mechanisms; one does not replace the other.
Rank #2
- The Shelly Pro 3EM 3CT 63 is a next-gen DIN rail-mountable energy meter for single or three-phase installations, featuring a 63A, 3-phase current transformer for non-contact measurements. It supports 4-quadrant measurement, optical pulse indication of energy usage, and is photovoltaic-ready. *It doesn't have a built-in relay; contactor control requires a Shelly Pro Addon attached to the device.
- Professional Smart Meter - Shelly Pro 3EM-3CT63 is a professional smart meter that reports accumulated energy, voltage, current, active, and apparent power per phase in real time. It stores data for up to 60 days in 1-minute intervals and includes a real-time clock to maintain accurate time if the SNTP server connection is lost.
- Ideal for business energy measurement - In commercial buildings, it helps monitor energy usage across floors or departments allowing accurate cost allocation and identification of energy wastage. In manufacturing plants it tracks energy consumption of heavy machinery, optimizing usage to reduce operational costs. For store owners it monitors energy usage of systems like lighting, HVAC § refrigeration, helping to identify inefficiencies § reduce energy bills while supporting sustainable practices
- Shelly Customer Service - Shelly is one of the fastest-growing Smart Home brands in the world with devices, providing solutions for the automation of private homes, buildings and businesses. We provide our customers with professional support and a 5 years device warranty.
- Shelly Smart Control App will help you control your Shelly devices remotely and will send notifications for all automated events in your home. You can easily configure devices and manage their settings individually, or you can create personalized scenes by combining Shelly devices to trigger certain actions in your home automation.
Adyen documents reusing an idempotency-key on outbound POST requests. Its API documentation says those keys remain valid for 7 to 14 days after first submission and apply account-wide at company-account level, with regional caveats. Those limits describe Adyen API requests, not how long to retain webhook deduplication records. See Adyen API idempotency documentation.
Handle out-of-order events as well as duplicates
A unique event key stops repeated processing of the same identified event; it does not guarantee events arrive in the order your business expects. Stripe explicitly does not guarantee event ordering. Adyen advises checking timestamps and notes that some webhook types carry a sequenceNumber.
Avoid blindly replacing current state with whatever an event says. Where order matters, compare a documented sequence or timestamp, or retrieve the current resource from the provider before applying a transition. Make that decision using the semantics of the event: timestamps can help, but should not be treated as a universal ordering mechanism unless the provider documents them for that purpose.
Recommended Free Tools
Quick Recap
Operational checks for a reliable webhook inbox
- Keep deduplication records long enough for recovery. Provider retry and manual replay windows differ, so set retention based on the provider and your own replay practices rather than assuming a universal duration.
- Make duplicate outcomes observable. Record that an event was recognized as a duplicate without repeating its business effect. Avoid logging sensitive payment data unnecessarily.
- Provide a safe retry path. A failed worker should be able to retry processing without repeating a completed external operation; retain enough state to distinguish accepted, in-progress, completed, and failed work.
- Reconcile important financial state. Use provider records or reports to investigate discrepancies rather than treating webhook delivery history as the sole source of truth.
- Recheck provider requirements when configuring endpoints. Retry policies, payloads, signature requirements, and acknowledgement rules can change and may vary by product or event type.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
