Every delivery is signed: HMAC-SHA256 of the raw body with your signing secret, sent in X-Turgo-Signature with a timestamp. Verify before trusting any payload — unsigned or stale requests aren't from turgo.
The scheme
Header X-Turgo-Signature: t=timestamp,v1=hex_hmac. Compute HMAC-SHA256(secret, timestamp + '.' + raw_body) and constant-time-compare against v1. Reject if mismatch or if the timestamp is older than 5 minutes (replay protection).
Implementation notes
Verify against the raw request body, not the parsed-and-reserialized JSON — reserialization changes byte order and breaks the HMAC. Both SDKs ship a verify helper that handles this correctly.
Secret rotation
Rotate from the webhook settings: during the overlap window turgo signs with both secrets (v1 and v2 headers) so you migrate verification without dropped events.
Why bother
An unverified webhook endpoint is an open door: anyone who finds the URL can forge events into your systems. Verification is ten lines of code — always ship it.
