Two Webhooks, One Rank: Race-Safe Payments with Postgres Advisory Locks
Two Webhooks, One Rank: Race-Safe Payments with Postgres Advisory Locks Payment webhooks get retried. Users double-click. Two rivals outbid each other in the same second. If your "apply payment" path isn't concurrency-safe, you get double-applied bids, phantom ranks, and money that doesn't match the leaderboard. I run Steal the Spot — a pay-to-rank leaderboard where every bid is money and every…
Two webhooks ensure race-safe payments using Postgres advisory locks. Payment webhooks may be retried, causing double applications and incorrect rankings. Steal the Spot, a pay-to-rank leaderboard, uses Supabase Postgres and Dodo webhooks to maintain a correct board. Three components are involved: serializing with an advisory lock, making the webhook idempotent, and locking rows to compute rank.
Advisory locks prevent stale snapshots and auto-release on commit or rollback. A service-role key executes the function, preventing client manipulation of ranks. The pattern successfully protects stealthespot.lol, a free ranking platform where users pay to climb.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
