Each webhook carries a timestamp and an HMAC-SHA256 signature of timestamp.body made with your signing secret. Compute the same HMAC on your server, compare it in constant time and reject old timestamps. Code samples are in the documentation.
Each webhook carries a timestamp and an HMAC-SHA256 signature of timestamp.body made with your signing secret. Compute the same HMAC on your server, compare it in constant time and reject old timestamps. Code samples are in the documentation.