set up woocommerce webhooks and verify their signatures

Steps

1. Create a webhook via the WooCommerce REST API by POSTing to `/wp-json/wc/v3/webhooks` with `name`, `topic` (e.g., `order.created`), `delivery_url`, and optionally `secret`.
2. WooCommerce generates a secret automatically if you don't provide one — retrieve it from the webhook object's `secret` field immediately after creation, as it is only shown once.
3. When a webhook fires, WooCommerce includes a `X-WC-Webhook-Signature` header containing a base64-encoded HMAC-SHA256 of the raw payload signed with the webhook secret.
4. In your handler, compute HMAC-SHA256 of the raw request body using the stored secret, base64-encode the result, and compare it to the header value using a constant-time comparison.
5. Respond with HTTP 200 within a short timeout to acknowledge delivery; WooCommerce marks webhooks as failed and eventually disables them after several consecutive delivery failures.
6. Re-enable a disabled webhook by sending a PUT to `/wp-json/wc/v3/webhooks/{id}` with `status: active`.