Ogni webhook include l'header X-TRPG-Signature: sha256=... per verificare l'autenticita'.

$secret   = 'whsec_...';
$body     = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $body, $secret);
$received = $_SERVER['HTTP_X_TRPG_SIGNATURE'] ?? '';

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit;
}