What you need to know
Webhook endpoints are public URLs by design, so an attacker could send a forged event if the endpoint trusts the JSON body alone. Signature verification adds an authenticity check.
How to apply it
Read the exact raw request body required by the provider, compute or verify its signature using a secret kept server-side, and reject invalid or stale requests. Then process valid events idempotently.
Common mistake to avoid
Do not parse and reserialize a body before verifying a signature if the provider signs the original bytes. Follow that provider's current verification guide.