How would you make sure a payment webhook never charges or provisions a customer twice?

Treat delivery as at least once and make the handler idempotent. Verify the signature first, then store the provider event id behind a unique constraint and return 200 immediately if you have already seen it. Do the state change and the id insert inside one transaction so a crash cannot half apply it. Keep the handler fast by queuing slow work, and let the provider retry when you genuinely fail.

The assumption I start from is that the provider will deliver the same event more than once, out of order, and sometimes hours late, because all three happen. So the handler verifies the signature and timestamp first, then inserts the provider event id into a processed_events table with a unique index. If that insert conflicts, we have handled it, and I return 200 straight away rather than doing the work again. The important detail is that the insert and the actual effect, granting the subscription or recording the payment, happen in the same transaction, so a process dying halfway cannot leave one without the other. Anything slow, like sending a receipt email, goes on a queue with its own idempotency key. I also store the event timestamp and ignore an event older than the state I already have, which is what saves you when a cancellation arrives before the upgrade that preceded it. On failures I return a 500 deliberately so the provider retries, and I alert if an event lands in the dead letter queue.