Webhooks
0-day streakReview

Your progress

Level 1

0 XP100 XP to level 2
0day streak
0best streak
0topics started
0cards reviewed
    Review cards

    Progress is stored only in this browser. No account is required.

    Layer 3 · Go deeper · 9 min

    Go deeper

    Size it, build it, then make the calls an interviewer will push you on.

    Back of the envelope

    Size it up

    Tap through each step of the arithmetic.

    Assume 10,000 merchants poll every 30 s. What does that cost?

      How long does the Standard Webhooks example schedule keep retrying?

        An endpoint taking 20 events/s is down 2 hours. How do you drain it?

          Build-up · 6 steps

          Follow one event out of the sender

          One payment event, from the database commit to a customer’s URL, and what happens when one customer’s endpoint stops answering.

          Step 1 of 6

          Commit the event with the order

          Posting from the request handler loses the event if you crash after the commit, and a slow endpoint slows checkout. So insert the event into an outbox table in the same transaction.

          4 interview moments

          You’re the candidate

          The interviewer pushes on the hard parts. Pick an approach and see how it holds up.

          1. Deep dive 1 of 4

            Interviewer

            “A big merchant gets 50 events a second, and its endpoint now hangs until your 10-second timeout. Everyone’s webhooks run late. What do you change?”

            Every endpoint shares one queue and a pool of 200 workers.

            Your move. Pick an approach:

          2. Deep dive 2 of 4

            Interviewer

            “Your handler marks the invoice paid in your accounting system, then returns 200. In the month-start burst, deliveries time out. What do you change?”

            Your move. Pick an approach:

          3. Deep dive 3 of 4

            Interviewer

            “A refund event for pay_8812 is stored, then a late “succeeded” arrives for the same payment. How does your receiver decide what’s true?”

            Your move. Pick an approach:

          4. Deep dive 4 of 4

            Interviewer

            “Your Shopify app’s endpoint was down all weekend, long past Shopify’s 8 retries over 4 hours. How do you make sure no order is lost?”

            Your move. Pick an approach:

          Build-up · 5 steps

          The receiver: verify, acknowledge, then work

          Four quick checks inside the request, each with its own answer for the sender, then the real work later, from the provider’s current data.

          Step 1 of 5

          Verify the signature

          Anyone can POST to your URL, and an unverified payment.succeeded is a free order. Recompute the HMAC over the bytes exactly as received, and compare in constant time.