Webhook

Instead of polling for changes, you give the provider a URL and it calls you when something happens. Webhooks are fast and cheap, but they come with rules:

• Verify the signature. Anyone can send a request to your endpoint.
• Expect repeats. Delivery is usually at least once, so the same event can arrive twice. Store event ids and skip ones you've handled.
• Don't rely on order. Act on the status in the event, not on the order events arrive in.
• Answer fast and do slow work in the background.
• Reconcile. A webhook is a notification, not the record.

On Valtu

Every delivery is signed twice over <timestamp>.<raw body>: X-Valtu-Signature-Ed25519 with your workspace's Ed25519 key (recommended, nothing secret to store) and X-Valtu-Signature with HMAC-SHA256. Reject anything signed more than 5 minutes ago, and verify the raw body exactly as received. Deliveries without a 2xx answer within 10 seconds are retried. constructEvent in the wallet kit and construct_event in the Python SDK do the checks. More in webhooks you can trust.