Verify webhooks with HMAC signatures
Webhook deliveries can now be signed with an optional secret and verified through the X-Signature header.
Webhook subscriptions created through the API can now include an optional signing secret. Recommand uses it to sign the raw request body with HMAC SHA-256 and sends the result in the X-Signature header.
See Working with Webhooks for setup and verification examples.