Glossary
What is Webhook signature?
A webhook signature is a code sent with each webhook, usually an HMAC made with a shared secret, that proves the request came from the service.
Your webhook URL is public, so anyone who finds it could post fake events to it. A signature stops that. You and the service share a secret; for each delivery the service works out an HMAC (a keyed hash) of the request and sends it in a header. Your code does the same sum with the same secret and accepts the request only if the two match. Including a timestamp in the signed data means an old request can't be replayed later.
Picture a Bournemouth hotel whose booking system marks a stay as confirmed when a guest replies to a text. Without a signature check, anyone who found the URL could confirm or cancel stays.
CaptiFi Connect signs every webhook with HMAC SHA-256 using the webhook's signing secret. The signature covers a Unix timestamp and the raw request body, so check it before you parse the JSON. The webhooks docs include a short Node.js example that also rejects anything older than five minutes.