What is Timestamp Tolerance?
Rejecting signed webhooks whose timestamps fall outside a narrow window, typically minutes. Tolerance windows shrink replay-attack surface: even a valid captured payload expires before attackers can reuse it.
Related terms
HMAC Signature Verification
Recomputing a hash-based signature over the raw webhook body with a shared secret and comparing in constant time. HMAC verification is the proof a callback came from the provider, not an impersonator.
Webhook Delivery Attempts
The provider retry schedule for webhooks: immediate attempts, spaced retries, then parked failures after a budget. BYOB run histories mirror this pattern, tracking each attempt so operators see exactly where delivery stands.
Webhook Verification
Cryptographically confirming payment callbacks actually came from the provider before fulfilling orders. Unverified webhooks let anyone grant themselves premium.
REST Resource Design
Modeling an API as nouns with stable URLs — /projects/:id/messages — instead of action endpoints. Resource design makes caching, auth scoping, and client reasoning predictable across every route.
Idempotent HTTP Verbs
GET, PUT, and DELETE produce the same result when safely retried; POST does not promise that. BYOB server routes use idempotent verbs for mutations clients may repeat after network timeouts.
Retry, Backoff & Jitter
Retrying failed calls after growing delays with random spread, so a fleet does not stampede a recovering service. Exponential backoff plus jitter turns synchronized thundering herds into gentle background noise.