Simulate provider callbacks before go-live
Payment and CRM webhooks ship with retry schedules you do not want to trigger against production on day one. POST sample events to a staging tunnel URL and watch your worker logs for parsing and idempotency handling.
Headers that matter
Content-Type, User-Agent, and vendor-specific signature headers must survive your reverse proxy. Compare echoed headers in the response with what your application middleware actually receives.
Idempotency and duplicates
Send the same event_id twice to confirm your store deduplicates. Providers guarantee at-least-once delivery; exactly-once processing is your responsibility.