Verifying webhooks with HMAC signatures

---

Attackers can forge HTTP callbacks. Verify signatures using the vendor’s documented scheme before side effects.

Why signatures matter

Unsigned webhooks are indistinguishable from arbitrary internet posts to your endpoint.

Implementing verify safely

Use constant-time comparison for HMAC equality. Parse the raw body exactly as received — JSON re-serialization breaks signatures.

Replay windows

Reject events with timestamps outside an acceptable skew, and track event IDs to drop duplicates.