Use a single server-side client that sets the environment origin, API key, timeout, idempotency key, and structured error handling. Keep the client out of browser-rendered code.

Create a hosted session

Reuse the same idempotency key after a timeout, then retrieve the resulting session before deciding to retry. Verify webhook signatures over raw bytes before response.json() parsing and return a fast success response after deduplication.