Webhook signatures
Confirm a delivery came from Tender Hunter before you act on it.
Check
Read the timestamp and signature headers, recompute the HMAC over the raw body, and reject the request if the timestamp is too old or the signature does not match.