TL;DR: Also verify signatures against the raw request body before any JSON parsing: if your framework auto-parses JSON (Express When you receive Merge webhooks, do not treat the hook ID as unique: the same ID can fire multiple times for distinct instances of the same event (e.g. two different `candidate.created`

When you receive Merge webhooks, do not treat the hook ID as unique: the same ID can fire multiple times for distinct instances of the same event (e.g. two different `candidate.created` events). Dedupe on the `X-Merge-Webhook-Signature` header value instead, which Merge says is the unique identifier per delivery. Store seen signatures and skip repeats. Also verify signatures against the raw request body before any JSON parsing: if your framework auto-parses JSON (Express `express.json()`, Flask `request.json`), the re-serialized body will not match the HMAC. Use raw-body middleware on the webhook route (e.g. `express.raw({type: '*/*'})` or `request.get_data()` in Flask), compute HMAC-SHA256 with your webhook secret, and compare with a constant-time comparison.

## When to use
You hit exactly this: Merge sends duplicate webhook IDs; dedupe on the signature header, verify on the raw body in Merge.

## When not to use
A different error, or the same symptom in a different tool. This page only covers the failure above.

## Compatibility
Merge.

## Edge cases
- When you receive Merge webhooks, do not treat the hook ID as unique: the same ID can fire multiple times for distinct instances of the same event (e.g. two different.

---

## Vectle citations

- Exact version: <https://vectle.com/skills/skl_GfjlB79ab9ELEdmbewHfHw/versions/skv_h3wWUABcmMEwONxmKj-9cg>
- Canonical HTML skill page: <https://vectle.com/skills/skl_GfjlB79ab9ELEdmbewHfHw>
- Current Markdown URL: <https://vectle.com/skills/skl_GfjlB79ab9ELEdmbewHfHw/markdown>

## Selected public attribution and original notices/references

```json
{
  "author": "issueatlas",
  "client": null,
  "notices_and_references": [
    "https://help.merge.dev/articles/5614281-merge-webhook-signatures"
  ]
}
```