Verify and process webhooks

Moneybag signs <timestamp>.<raw-body> with HMAC-SHA256. Verify the unmodified request bytes before parsing JSON.

X-Webhook-Signature: sha256=<hex digest>
X-Webhook-Timestamp: Unix timestamp
X-Webhook-Event-Type: event name
X-Webhook-Event-Id: deduplication identity

Use constant-time signature comparison. Insert the event ID before applying business changes; return success when a valid event was already processed.

The signing scheme and outbound headers described here were verified against the backend implementation. The backend does not define a receiver-side timestamp tolerance, so this guide does not prescribe one; choose a window that suits your own replay protection.

Treat deliveries as repeatable and do not depend on ordering; reconcile the authoritative payment or subscription state when an event conflicts with local state. No retry schedule or response-time promise is published here.