Aglet

Learn from webhook replay incidents

The lasting lesson is that authentication, recency, and effect identity answer different questions. Preserve the repeated event and the decision boundary that mattered. Document clock, sender retry, manual resend, and deduplication retention assumptions without claiming exactly-once delivery for the receiver path.

Keep the lesson for the next incident

  1. Document replay rules

    Record signed timestamp, receiver clock, freshness tolerance, stable event ID, delivery ID, deduplication retention, duplicate acknowledgement, and review path. Define how old business timestamps differ from delivery freshness. Preserve the receiver clock alongside the signed time.

  2. Keep repeat fixtures

    Retain fresh, repeated, stale, manual-resend, old-business-time, missing-ID, race, and post-effect cases with synthetic events. Store expected handler and side-effect outcomes. Include the original replay shape for future storage or verifier changes.

  3. Review repeat signals

    Watch repeated IDs, stale signatures, clock drift, duplicate effects, claim races, and identity gaps by endpoint. Assign an owner and threshold. Close the follow-up only when freshness and effect checks cover every supported receiver path.

What to carry forward

Close learning with identity and freshness rules, replay fixtures, deduplication ownership, and review signals. Keep sender and clock limits visible. The durable outcome is a deliberate no-op or review path for repeated events. Review deduplication retention with the replay window.

Technical background: Coinbase developer documentation.

Keep the decision with the work.

Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.

Create an account See the product workflow