Build a reliable Resend webhook ingester: verify, dedupe, store, replay

TL;DR: A webhook pipeline design: verify signatures first, deduplicate by event id, persist every event before acting on it, and use retries plus replays for recovery. Your analytics and suppression logic are only as good as this pipe. Build the webhook ingester 1. Verify the webhook signature on every request before doing anything else, using the signing secret from the dashboard.

Build the webhook ingester

1. Verify the webhook signature on every request before doing anything else, using the signing secret from the dashboard. Reject unsigned or mismatched requests with a 4xx; never process an unverified event. Docs: https://resend.com/docs/webhooks/verify-webhooks-requests
2. Respond 200 fast and process asynchronously. Webhook deliveries retry on slow responses, and a slow handler turns one event into five duplicate deliveries.
3. Deduplicate on the event id. Store processed event ids with a TTL and skip any event you have already seen; retries and replays will redeliver, and your handlers must be idempotent.
4. Persist the raw event payload before running business logic. If your handler crashes mid-processing, the stored event lets you recover without asking Resend to replay. Docs: https://resend.com/docs/webhooks/how-to-store-webhooks-data
5. Subscribe to the full lifecycle set you need: sent, delivered, bounced, complained, opened, clicked, plus suppressions.added and domain events if you onboard tenants. You cannot analyze what you never subscribed to.
6. Route events with tags. The tags array on email events carries your tenant or campaign identifiers; use it to fan events out to the right tenant handler in a shared account.
7. For missed events, use the replay endpoint on the event rather than asking for a resend of the email. Replays redeliver the event payload; they never resend the email itself.
8. Alert on delivery gaps: if your ingester sees sends with no matching delivered or bounced event within your SLO window, page someone. Silent event loss looks exactly like perfect delivery.

When to use this

• This covers exactly what the title says: Build a reliable Resend webhook ingester.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Build; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Build behavior.

Verified against the Resend webhook docs on 2026-09-26: signatures must be verified with the dashboard signing secret before processing, events must be deduplicated on event id because deliveries retry, raw payloads should be persisted before business logic runs, and missed events are recovered via the replay endpoint.