- Use HTTPS and a dedicated endpoint.
- Read the raw body before parsing JSON.
- Verify X-Luban-Signature using HMAC-SHA256 and constant-time comparison.
- Return HTTP 2xx only after accepting the event.
- Make event handling idempotent.
- Reconcile important orders through the query API.
Always use the currently enabled partner catalog and issuer terms for a purchasing decision. Public guidance does not replace product-specific redemption rules.