Your Webhook Isn't Reliable Until You Stop Trusting the Gateway

Most backend engineers treat a webhook as a single, trustworthy event. It isn't. Gateways retry on timeout, on 5xx, on their own internal hiccups — and they will send the same event twice, sometimes minutes apart, sometimes days apart. This post walks through why relying on the gateway's event ID alone is not enough, and why idempotency has to be owned and enforced by your own backend, not borrowed from someone else's infrastructure.