src/Api/Webhook.php
public function verifyWebhookSignature(int $timestamp, string $token, string $signature): bool
    {
        if (empty($timestamp) || empty($token) || empty($signature)) {
            return false;
        }

        $hmac = hash_hmac('sha256', $timestamp.$token, $this->apiKey);

        if (function_exists('hash_equals')) {
            // hash_equals is constant time, but will not be introduced until PHP 5.6
            return hash_equals($hmac, $signature);
        } else {
            return $hmac === $signature;
        }
    }
public function verifyWebhookSignature(int $timestamp, string $token, string $signature): bool
    {
        if (empty($timestamp) || empty($token) || empty($signature)) {
            return false;
        }

        $hmac = hash_hmac('sha256', $timestamp.$token, $this->apiKey);

        if (function_exists('hash_equals')) {
            // hash_equals is constant time, but will not be introduced until PHP 5.6
            return hash_equals($hmac, $signature);
        } else {
            return $hmac === $signature;
        }
    }
public function verifyWebhookSignature ( int $ timestamp , string $ token , string $ signature ) : bool { if ( empty ( $ timestamp ) || empty ( $ token ) || empty ( $ signature ) ) { return false ; } $ hmac = hash_hmac ( 'sha256' , $ timestamp . $ token , $ this -> apiKey ) ; if ( function_exists ( 'hash_equals' ) ) { // hash_equals is constant time, but will not be introduced until PHP 5.6 return hash_equals ( $ hmac , $ signature ) ; } else { return $ hmac === $ signature ; } }
This function verifies the webhook signature with your API key to to see if it is authentic.

If this function returns FALSE, you must not process the request.
You should reject the request with status code 403 Forbidden.
This function verifies the webhook signature with your API key to to see if it is authentic .