Best practices
| What | Why |
|---|---|
Deduplicate notifications by the X-Event-Id header (also sent as RequestID) | It does not change between delivery attempts, and the attempt number is separate in X-Event-Attempt. Answer 200 to a repeat: an error on a duplicate makes the sandbox retry |
| Verify the signature of the incoming notification | It arrives in the body (Now and Signature) and is computed with the same secret of yours. As with one-time payments, the timestamp is signed, not the body — it does not guarantee payload integrity |
| Do not rely on the callback as the only source of state | After the seventh failed attempt delivery stops — the next step would fall outside the sandbox’s one-minute window; the status is always available via GetSubscriptionStatus |
| Keep the handler fast | Answer 2xx immediately and move heavy work to a queue: a timeout counts as failure and redirects are not followed |
Store the SubscriptionID yourself | In the production service it is what identifies the subscription in every later call |
| Do not use the demo credentials outside the sandbox | The sandbox project and its secret are shared by everyone who opened this page |