Every webhook request carries three headers: X-PulseWatch-Event, X-PulseWatch-Timestamp and X-PulseWatch-Signature.

The signature is sha256= followed by the HMAC-SHA256 of timestamp + "." + raw body, using the signing secret shown when you created the channel.

To verify: rebuild the HMAC with your secret, compare it to the header with a constant-time comparison, and reject requests whose timestamp is more than five minutes old.