What is a Webhook Signature?

The sending service computes the HMAC of the raw request body (and often a timestamp, to prevent replay) using a secret both parties know, then attaches the result as a header like `X-Signature` or `Stripe-Signature`. The receiver recomputes the same hash locally over the exact bytes it received and compares it to the header value using a constant-time comparison, never a plain string equality check, since naive comparisons leak timing information an attacker could exploit. Signature verification is the single most important control on any public webhook endpoint, because the URL itself is often guessable or leaked in logs. Without it, anyone could POST a fabricated "payment succeeded" or "user upgraded" event straight to the endpoint. Including a timestamp in the signed payload and rejecting requests outside a short tolerance window also blocks replay attacks where an old, legitimately-signed request is resent later.