Why a 24-hour webhook dedupe key can silently drop events, and the 120-second fix

Munchable's Stripe and inbound email webhooks both risk duplicate side effects because providers deliver at-least-once. The team uses a Redis SET NX key with a TTL to claim each event, so retries return early. A 24-hour claim is the wrong choice: if the handler crashes midway, the key marks the work as done and the provider's retries are silently ignored, losing the event. The solution writes a short 120-second processing claim, extends it to 24 hours only on success, and deletes it on caught errors so retries proceed. The 120-second window is set to exceed the route's 30-second maximum duration, covering crashes where no code can run.