> For the complete documentation index, see [llms.txt](https://docs.paymento.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.paymento.io/payment-links/webhooks-for-payment-links/best-practices.md).

# Best Practices

#### 1. **Always Verify Signatures**

Never skip signature verification. This is your primary defense against fraudulent webhooks.

#### 2. **Use HTTPS Endpoints Only**

Paymento only sends webhooks to HTTPS URLs to ensure data security in transit.

#### 3. **Respond Quickly**

Your webhook endpoint should respond with a `200 OK` status code within 5 seconds. Do heavy processing asynchronously.

#### 4. **Handle Idempotency**

Webhooks might be delivered more than once. Use the `event.id` to track processed events and avoid duplicate processing.

#### 5. **Log Everything**

Keep detailed logs of all webhook requests for debugging and auditing.

#### 6. **Test Your Endpoint**

Use the "Test Webhook" feature in the Paymento dashboard to verify your endpoint is working correctly before going live.

#### 7. **Use Environment Variables**

Never hardcode your secret key. Use environment variables or secure configuration management.

#### 8. **Handle Errors Gracefully**

If your endpoint fails, return appropriate HTTP status codes:

* `200` - Successfully received and processed
* `401` - Invalid signature
* `500` - Internal server error (Paymento will retry)