@capitaharlock A follow-up on keeping the two jobs apart. The webhook docs now state the split: the V2 signature covers the timestamp, the delivery id and the raw body, so a copied delivery can’t be replayed. The body-only signature stays only for existing integrations (send21 webhooks: events, payloads and signatures). We also added a durable receiver to the examples, because a dedupe set in memory forgets everything on restart. It stores X-Send21-Delivery and applies the order update in one SQLite transaction, and returns 2xx only after the commit: send21-examples/examples/webhook-receiver-sqlite at main · send21io/send21-examples · GitHub
When you added the timestamp and delivery id on your side, did you keep delivery ids in the same transaction as the business write, or in a separate store with its own cleanup?
- send21