401 on every delivery
- Confirm
SKYLINE_WEBHOOK_SECRETmatches the secret shown at registration - Verify you hash the raw request body (before JSON parsing)
- Check clock skew — server time must be accurate
Events never arrive
- Endpoint must be HTTPS with a valid certificate
- Return 2xx — repeated 4xx/5xx pauses delivery
- Confirm the webhook is scoped to the right platform/event types
Duplicate events
Expected — delivery is at-least-once. Dedupe oneventId.