Your service receives webhooks from a payment provider. How do you make handling them secure and reliable?
What the interviewer wants to hear
- Verify the signature on the raw body and check timestamps
- Respond quickly with 2xx and process asynchronously
- Deduplicate by event id because deliveries can repeat
- Handle out-of-order events, for example by fetching current state
- Monitor failures and support replay or reconciliation
Model answer
First, security: I verify the HMAC signature over the raw request body using a constant-time comparison, and reject events with old timestamps to stop replays. Then I store the event and return 200 quickly, because providers time out and retry if the handler is slow. The real processing happens in a background worker that reads from a queue or the stored events table. Providers deliver at least once, so I deduplicate using the event id with a unique constraint, which makes processing idempotent. Events can also arrive out of order, for example "refunded" before "paid", so I either compare timestamps or versions, or fetch the latest object state from the provider API before updating. Finally, I alert when processing fails, keep failed events for replay, and run a periodic reconciliation job that compares our records with the provider's in case a webhook was missed entirely.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Backend Developer questions
- An API endpoint is slow because it runs a heavy database query. How would you add caching, and how do you keep the cache correct?
- You need to rename a column in a large production table that the live app uses. How do you do it without downtime?
- How do you change a public API without breaking existing clients, such as old mobile app versions?
- Users say one API endpoint has become slow in production. How do you find and fix the cause?
- Sending emails and generating PDF invoices makes your checkout API slow. How would you move this work to the background?
- How would you add rate limiting to a public API that runs on many servers?
- You are asked to review the security of a REST API before launch. What would you check?
- When would you choose Kafka and when RabbitMQ for messaging between services?
- How would you design an API that lets users upload large files, such as videos of several gigabytes?