Each webhook request includes a `pdfcraft-signature` header containing a timestamp and a HMAC-SHA256 hash of `{timestamp}.{raw_body}`, signed with your webhook secret.
To verify: split the header on commas, recompute the HMAC with your secret, and compare in constant time. Reject the request if the timestamp is older than 5 minutes (replay protection).
If you rotate the webhook secret, both the old and new signatures are accepted for 24 hours so you have time to deploy the new key.