Webhook Signature
An HMAC over the raw request body using a shared secret, letting a receiver verify a webhook genuinely came from the provider.
Without it, the endpoint accepts a POST from anyone who learns the URL — and a forged "payment succeeded" is a straightforward fraud.
The implementation details that are easy to get wrong and defeat the control:
Verify over the raw bytes, before any parsing or middleware reformatting. Re-serialising the JSON changes the bytes and the signature will not match — or worse, a lenient implementation compares against a re-serialised body and accepts modified content.
Use constant-time comparison, so the check does not leak the expected value through timing.
Include a timestamp in the signed payload with a tolerance window, or a legitimately captured webhook can be replayed indefinitely.
Support two secrets simultaneously, so the secret can be rotated without dropping deliveries.
IP allow-listing is not a substitute; providers change addresses and the header can be spoofed upstream of you.