The Hidden Trap in Backend Tutorials: Why Your Webhooks Are Creating Duplicate Data (And How to Fix It)

We've all been there. You're sitting at your desk late at night, watching a backend tutorial, fueled by coffee and determination. The instructor shows you how to integrate a payment gateway or a webhook, and it looks incredibly simple:

1. Receive the webhook event.
2. Update the database.
3. Return a 200 OK.

You write the code, test it locally, and it works perfectly. You push it to production feeling like a senior engineer.

But a few days later, you check your database and notice something terrifying: Duplicate records. Users are being credited twice, or identical data entries are piling up.

Welcome to the real world of backend engineering, where the "Happy Path" is a myth, and network reliability is a lie.

Here is what went wrong, and the crucial concept of Idempotency that tutorials often skip.

The Problem : The Unreliable Network
In a perfect world, when an external service (like Stripe, GitHub, or Razorpay) sends a webhook to your server, your server processes it instantly and fires back a 200 OK to say, "Got it, thanks!"

But networks are inherently flaky. Sometimes, your server takes too long to process the data. Other times, a DNS hiccup drops your 200 OK response before it reaches the external service.

When the external service doesn't get your confirmation in time, it assumes the event was lost. So, what does it do? It retries. It fires the exact same webhook event again a few seconds (or minutes) later.

If your code blindly accepts data and inserts it into the database, you've just processed the same event twice.

The "Aha!" Moment: Enter Idempotency
To fix this, we need to design our API to be Idempotent.

Idempotency is a fancy mathematical term that simply means: Making multiple identical requests has the same effect as making a single request.

Think of it like an elevator button. Pressing the "Floor 5" button once tells the elevator to go to floor 5. Smashing the "Floor 5" button ten times in a row doesn't make the elevator go to floor 50. The end result is exactly the same.

Your webhook endpoint needs to act like that elevator button.

How to Implement an Idempotent Webhook
To stop duplicate data, you need to turn your server into a bouncer. Before letting any data in, it needs to check the guest list.

Here is the step-by-step logic to fix the issue:

1. Find the Unique Identifier
Every well-designed webhook payload contains a unique ID for that specific event (e.g., event_id or stripe_signature). This is your golden ticket.

2. Check the Database Before Processing
When the webhook hits your server, do not process the business logic immediately. First, query your database to see if you have already processed this event_id.

3. Handle the Duplicate Gracefully
If the event_id exists, it means this is a network retry. Your server should safely ignore the payload and immediately return a 200 OK to satisfy the external service.

If the event_id does not exist, process the data, save the event_id to your database, and return the 200 OK.

The Code Example (Node.js / Express)
Here is what that mental shift looks like in code:

app.post('/webhook', async (req, res) => {
  const eventId = req.body.event_id;
  const payloadData = req.body.data;

  try {
    // 1. Check if we've already processed this event
    const existingEvent = await db.processedEvents.findUnique({
      where: { id: eventId }
    });

    // 2. If it exists, it's a retry! Ignore it, but send a 200 OK.
    if (existingEvent) {
      console.log(`Duplicate event ${eventId} blocked.`);
      return res.status(200).send('Event already processed');
    }

    // 3. If it's new, process the business logic safely
    await updateUserData(payloadData);

    // 4. Save the event_id so we remember it for the future
    await db.processedEvents.create({
      data: { id: eventId }
    });

    // 5. Finally, send the success response
    return res.status(200).send('Webhook received and processed');

  } catch (error) {
    console.error("Webhook processing failed", error);
    return res.status(500).send('Internal Server Error');
  }
});

The Takeaway
Tutorials are amazing for learning the syntax and the basic flow of a framework. But the transition from a "learner" to a "builder" happens the moment you start dealing with real-world edge cases.

Building systems that work when everything goes perfectly is easy. Engineering systems that gracefully handle failure, retries, and latency is the real challenge and the real fun.

Have you ever had a network retry cause havoc in your database? How do you handle idempotency in your own APIs? Let me know in the comments below!