How do I receive webhook data?

The receiving end, step by step

1. Ask Lovable to create the endpoint:

"Create a server function that accepts incoming webhook POST requests from [service], saves the payload into a webhook_events table, and processes it to update [whatever record it relates to]."

2. Give that function's URL to the sending service.
3. Store the raw payload (not just the fields you think you need) alongside a processed/unprocessed flag — this makes debugging far easier later, and lets you reprocess if your handling logic had a bug.

Structuring the table

A simple webhook_events table typically holds: source, event type, raw payload (JSON), received timestamp, and a processed flag. Keep it separate from your main business tables — process the event, then update the relevant order/booking/subscription record from there.

Idempotency matters

Providers often deliver the same event more than once. Store the provider's event ID and check it before processing, so a retry doesn't double-charge, double-book, or double-send an email.

Security

• Verify the payload's signature against the provider's shared secret where they offer one (Stripe, GitHub, and most mature APIs do).
• Don't trust field values blindly — validate types and required fields before writing to your database.
• Keep the secret used for verification server-side, never in front-end code.

What usually goes wrong

• No logging of raw payloads, so when something goes wrong there's nothing to inspect.
• Treating the webhook call as fully synchronous with slow downstream work (like sending an email) inside it, causing timeouts and provider retries that compound the problem.
• Forgetting the endpoint needs to be public and reachable — a URL that works in preview but is blocked or different in production is a common gap, see /questions/why-is-my-api-working-in-preview-but-not-production.