An application receives duplicate webhooks and must avoid sending multiple refund requests for the same event. Which approach best fits?

1. Validate authentication tokens and enforce authorization in the service.
2. Honor retry guidance with bounded backoff and a defined failure path.
3. Use the attached service account with application default credentials.
4. Persist an idempotency record tied to the webhook's stable business identifier.