The receiver should verify the documented signed message over the raw request payload and relevant timestamp using its configured webhook secret. Modification of the body before verification can make a valid signature fail. Use constant-time comparisons and prevent replayed events when the integration specifies delivery identifiers.
Key facts
- The raw body can be required for validation
- Webhook secrets are separate from public API output
- Replay handling matters during retries