Verify webhook signature

All webhooks callbacks are signed.

You can find the signature in the request header "Pongo-Signature" and it looks like this : t={timestamp},v1={hmac} where :

{timestamp} is the timestamp when the webhook was send
{hmac} is a sha256 hash of "request body + timestamp", with the webhook secret as key

So to verify the signature you just have to calculate the sha256 of "request body + timestamp" with your secret as key and compare it to the value of "v1=".

Supported webhook events

Event	Description	Request body
`customer.created`	Triggered when a customer was created	See GET customer
`customer.updated`	Triggered when a customer was updated
`store.created`	Triggered when a store was created	See GET store