public function validateWebhookNotification($json_data) {
        // validate vars
        if (!strlen($json_data['apiToken'])) { throw new AuthorizationException("API token not found"); }
        if ($json_data['apiToken'] != $this->api_token) { throw new AuthorizationException("Invalid API token"); }
        if (!strlen($json_data['signature'])) { throw new AuthorizationException("signature not found"); }
        $notification_json_string = $json_data['payload'];
        if (!strlen($notification_json_string)) { throw new AuthorizationException("payload not found"); }

        // check signature
        $expected_signature = hash_hmac('sha256', $notification_json_string, $this->api_scret_key, false);
        $is_valid = ($expected_signature === $json_data['signature']);
        if (!$is_valid) { throw new AuthorizationException("Invalid signature"); }

        // this will always be true
        //   otherwise an exception will be thrown by now
        return $is_valid;
    }