• Signature mismatch: verify HMAC secret and raw body usage — see Webhook Verification and Retries for the exact signing scheme.
• Timeout: reduce handler latency or queue work asynchronously. • Endpoint unreachable: validate DNS, TLS chain, and firewall allowlists.