Treat outbound events as a documented interface

A webhook is an interface

Outbound events are part of the product surface. They deserve stable event types, identifiers, timestamps and documented delivery behaviour, just like an inbound API. A customer should not need an unpublished partner channel to receive important product events.

A clear event contract also makes internal ownership easier: application teams know what they can depend on, and security teams know how the sender is authenticated.

At-least-once is an operational promise

Distributed delivery can fail after the receiver has accepted an event but before the sender sees the acknowledgement. Retrying is the safe response, which means duplicates are possible. Treating duplicates as normal and giving every event a stable identifier is more robust than pretending exactly-once delivery exists across the network boundary.

Consumers can durably accept an event, deduplicate by identifier and then perform their own downstream work.

Signatures protect the boundary

TLS protects transport, while a message signature lets the receiver verify that the event was produced by the expected sender and has not been altered. Timestamp validation can also limit replay windows.

Secrets still need ordinary credential hygiene: show them only where necessary, store them safely and never write them into application logs.