Never trust a payment webhook on its first word

A payment webhook is, structurally, a stranger sending your server a POST that says "this person paid." If your handler believes it, anyone who can reach that URL can mark orders as paid. In Saturdays, where PhonePe settles real money for food orders, the webhook handler is the most defensive code in the system — and every step in it exists because the step before it isn't enough. The handler most tutorials give you def payment_webhook(request): data = json.loads(request.body) order = Order.objects.get(id=data["order_id"]) if data["status"] == "SUCCESS": order.mark_paid() Count the assumptions: that the request came from the gateway, that the body wasn't altered, that SUCCESS means the money actually arrived, that the amount matches the order, that this event hasn't already been processed, and that nothing else is changing this order at the same moment. Every one of those is a separate way to lose money. Five steps, in this order 1