Keep Free Lanes Off the Signed Webhook Path
The billing webhook stalled for forty-one silent seconds. The payment provider sent the same event again. A free-lane agent was still classifying intent. The worker then granted store credit twice. On-call found duplicate ledger rows before dawn. This write-up reconstructs a common incident pattern. It is not a named customer report. The root bug was placement, not prompt quality. Signed webhooks…
Free lanes should not sit on signed webhook paths. This rule is crucial for preventing billing webhook delays and duplicate entries that can occur when a free-lane agent is still processing intent. Providers will retry on timeouts and 5xx replies, without waiting for an agent to complete its task. Duplicate deliveries are collapsed into one effect, so a free model can still assist later workers.
However, the free server hosting workers must not terminate the public webhook callback. Duplicate rows on the ledger were discovered before dawn due to this pattern. The root issue is placement, not prompt quality. Signed webhooks are punishing for slow and overly complex handlers. Providers will retry on timeouts and 5xx replies, as they do not wait for an agent to finish thinking.
Idempotency keys are derived from a model prompt, and clock skew handling is managed in generated prose. The public endpoint runs on a preemptible free server, and a model timeout can lead to a provider retry storm. Unsigned fixtures should not share the production hostname, and signing secrets must not follow that host. The accept path should be simple Node code, with signature checks running before any semantic parsing. The HTTP status is independent of model output, and duplicate deliveries collapse to one effect.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
