The webhook is the easy part
Verify the signature over the raw body, persist the event, enqueue, and return 200 inside a second. Anything slower or non-2xx counts against the subscription's health, which is how a working integration quietly stops receiving events.