Receive a Payment Webhook
Decide what you would build from the brief alone. Everything below it is available, but the exercise stops working if you open it first.
Accept payment events from your provider and mark orders as paid. The provider retries any non-2xx and does not guarantee ordering.
Verifying the signature carefully, then trusting the provider not to send duplicates because the docs describe each event as sent once. The provider retries on timeout and on any non-2xx — so a handler that fulfils the order and then times out while responding will be called again with the same event, and will fulfil again. The signature check is real security and it does nothing about this. Duplicate fulfilment reads as a fulfilment bug, and nobody looks at the webhook handler.