Integration
Verifying a webhook signature, and the three ways it goes wrong
An HMAC over the request body proves the sender holds your secret. The verification is four lines — the failures are re-serialising the body, comparing with ===, and forgetting that a valid signature never expires.
