# Webhook Ingestion & Replay Protection

**Document Version:** 1.0.0 (Phase 21)

---

## 1. Webhook Signature Verification

Inbound webhooks are validated using HMAC-SHA256 signatures passed in `X-LeadPilot-Signature` or `X-Hub-Signature-256`.

---

## 2. Replay Defense

Duplicate webhook deliveries identified by event ID (`X-Event-ID` or `payload['event_id']`) are logged as `ignored_duplicate` without creating duplicate leads in the sales pipeline.