Webhooks
Inbound HTTP you do not control: signature verification on the raw payload, duplicate delivery as the normal case, and ordering you cannot assume.
A third party calls your API on its schedule, with its retry policy, and treats your endpoint as infrastructure it depends on.
Proving the request came from the provider — computed over the raw bytes, compared in constant time, bounded by a timestamp.
Providers retry, so duplicate delivery is the normal case — deduplicate on the provider event id, atomically.
The provider decides when to retry and does not promise order, so your handler must be correct for events that arrive late, twice, or backwards.
When you are the provider: delivering to endpoints you do not control, without letting a slow customer take down your service.