I've set up webhooks in a PayPal sandbox account and receive them on my backend and verify them, getting back {verification_status: 'SUCCESS'}. However, the PayPal developer dashboard shows the webhooks as 'Pending', meaning they keep resending/retrying.
What needs to happen so I stop getting repeat webhooks?
For webhook delivery to be successful, the server receiving the webhook needs to respond with an HTTP status of 2xx -- rather than anything else, such as 4xx or 5xx or no response.
Verifying the webhook is for your own information, to confirm it was sent by PayPal and not some other (malicious/spoof) actor. You can also verify by checking the cryptographic signature rather than posting it back to the PayPal API.