What is webhook signing?
When you supply a secret, the delivery carries a signature header of the form sha256=<hex>, computed as an HMAC-SHA256 of the raw request body with that secret, alongside headers naming the event and the job. Verification means recomputing that HMAC over the raw bytes — not the re-serialized JSON — and comparing in constant time.
Why it matters
An unsigned webhook endpoint accepts a completion notice from anyone who guesses the URL. The raw-bytes detail is the part people get wrong: re-serializing the JSON before hashing changes the bytes and the signature will never match.