Test your receiver with sandbox events before enabling live. Use an HTTPS tunnel you control and delete the endpoint afterward.
Prepare the receiver
Your server must preserve the original body, validate the signature header, and return 2xx after durable persistence.
Run minimum cases
- Valid delivery
- Invalid signature
- Expired timestamp
- Duplicate event
- Handler timeout
500 response- Replay of the same event
Confirm that duplicate events do not repeat financial or inventory effects. Keep only sanitized IDs and statuses in evidence.
Do not bypass signature verification in development. Sandbox enforces the same
cryptographic boundary as live.
