The Durable Intake Architecture — Queues Behind Endpoints, DLQs, and Poison Events
The naive webhook handler does everything inline: receive, verify, run business logic, call three services, return 200. It works in the demo and fails in every interesting way in production — timeouts under load, lost events on deploy, one bad payload blocking the stream. The production architecture is almost boringly uniform across serious teams: a thin endpoint that durably enqueues and immediately acks, workers that process from the queue, and explicit machinery for the events that refuse to process. This post builds that architecture piece by piece.
The production receiver: a thin verifying endpoint that durably enqueues and acks in milliseconds, workers processing idempotently partitioned by resource, bounded retries for transients, and a monitored, diagnosable, replayable DLQ so one poison payload never dams the stream. The dashboard falls out of the design.