How to Build a Rotation-Safe Webhook Receiver: Verify Raw Signatures for Property Billing

To build a webhook receiver that survives key rotation, verify each signature against the raw body, bind the verified key to a property account, enqueue that evidence, and acknowledge only after the durable write. At 03:07, the page says webhook_auth_failures_high. The property-management API is still serving residents, but payment and maintenance events from several buildings are being rejected just after a production key rotation. The dashboard shows a tidy error-rate line. It does not answer the useful question: which key identifier failed, for which property account, and did any rejected e