Glossary

Replay protection

Refusing a valid, signed message that is old or already processed, so a captured request cannot be sent again.

At OneLifeVibe

• A OneLifeVibe webhook's timestamp is part of what is signed. Receivers should reject anything more than 5 minutes (300 seconds) from their clock and dedupe on webhook-id.

Related terms

• Webhook signature (HMAC-SHA256)
• Idempotency