## Webhook handler architecture 
Follow these guidelines:
1. Accept the `POST` request with the body and headers as-is, **without modification**.
2. [Verify the webhook signature](/webhooks/section/webhook-listener/generation-of-signature) and return the appropriate status code:
  * `4xx` — if the signatures don’t match;
  * `2xx` — in success cases. We recommend returning `204 No Content` **before** executing the main business logic. `200 OK` is also acceptable.
3. Pass the payload to an async job or queue for further processing.
4. Implement [idempotency](https://en.wikipedia.org/wiki/Idempotence#Computer_science_meaning). You must ensure your system can handle [receiving the same webhook more than once](/webhooks/section/webhook-listener/sending-responses-to-webhook).

**Flow example:**

```http
HTTP POST /webhooks/xsolla
  read raw_body, headers
  if !verify_signature(raw_body, headers['authorization']):
     return 400 {"error":{"code":"INVALID_SIGNATURE","message":"Invalid signature"}}
  enqueue(raw_body)
  return 204  # or 200
```