Handling Razorpay webhooks the right way

Payment bugs are the most expensive bugs. Here is the checklist I follow whenever I integrate Razorpay (or Stripe, or PayPal).

1. Verify the signature of every webhook before reading the payload.
2. Make handlers idempotent — the same event can arrive more than once.
3. Treat the webhook as the source of truth, not the redirect back from checkout.
4. Log everything with the payment and order IDs.

$expected = hash_hmac('sha256', $request->getContent(), config('services.razorpay.webhook_secret'));

abort_unless(hash_equals($expected, $request->header('X-Razorpay-Signature')), 403);