Your webhook handler fulfils orders. Logs show the provider sometimes delivers the same payment.succeeded event twice. What is the right fix?

Record each processed event ID and skip events you have already handled. Webhooks are delivered at least once. Retries after timeouts or lost acknowledgements can't be avoided, so the same event can arrive twice. Your handler must be idempotent: handling an event twice must have the same effect as handling it once.

"Return 500 on the second delivery so it stops" does the opposite of what you want. Providers treat a 500 as a failure, so they retry again.