Use webhooks only when event names, payload versions and the signature contract are officially published.
Delivery
Acknowledge quickly and process idempotently; treat replay and out-of-order delivery as normal cases.
Verification
Take the header name, algorithm, timestamp tolerance and raw-body rules from the published contract; do not guess them.
Reconciliation
A webhook is not the only source of truth. Reconcile critical billing/provider state through a supported API or administrative workflow.