From Dev.to
Webhooks arrive twice and out of order: making payment callbacks duplicate-safe in Laravel
In my last post I wrote about proving a payment callback is real: verify the signature, then ask the gateway for the status instead of trusting the payload. That solves "who sent this?". It doesn't so...