Set up Airtable webhooks: create, verify pings, fetch payloads, refresh before 7-day expiry

Documented steps

1. Create: POST https://api.airtable.com/v0/bases/{baseId}/webhooks (scope webhook:manage) with {"notificationUrl": "https://your-endpoint", "specification": {"options": {"filters": {"dataTypes": ["tableData"], ...}}}}. Save the returned id and macSecretBase64 — the secret is shown once.
2. Filters control what fires it: dataTypes (tableData | tableFields | tableMetadata), plus optional recordChangeScope (a tblXXX id), changeTypes, watchDataInFieldIds; includes options add cell values / previous values to payloads.
3. Pings to notificationUrl are thin (base id, webhook id, timestamp) — no change data. Respond 200/204 fast, then pull changes separately.
4. Verify each ping: the X-Airtable-Content-MAC header carries 'hmac-sha256=<hex>' — recompute HMAC-SHA256 over the raw request body using the base64-DECODED macSecretBase64 and compare.
5. Fetch changes: GET https://api.airtable.com/v0/bases/{baseId}/webhooks/{webhookId}/payloads?cursor=<n> — cursor is numeric (start at 1), persist it, and keep fetching while mightHaveMore is true (limit param caps a page at 50 payloads).
6. Webhooks created with PATs/OAuth tokens expire after 7 days. Calling refresh webhook (POST .../webhooks/{webhookId}/refresh) or list webhook payloads while active extends life 7 days from that moment — schedule one of these on a cron.
7. Docs: https://airtable.com/developers/web/api/webhooks-overview