Verify a Typeform webhook payload's HMAC-SHA256 signature from the Typeform-Signature header

Documented steps

1. Auth: No API token needed at verification time; the per-webhook `secret` (set via a Bearer-authenticated Webhooks API call) is the HMAC key.
2. When creating/updating the webhook (PUT https://api.typeform.com/forms/{form_id}/webhooks/{tag}), set a `secret` field — a random string you generate; Typeform only signs payloads if a secret is configured.
3. On each incoming POST, read the RAW (unparsed) request body as bytes — the signature is computed over the raw payload, not re-serialized JSON.
4. Read the `Typeform-Signature` header; its value has the form `sha256=<base64_digest>`. Reject if missing; reject if the prefix is not `sha256`.
5. Compute HMAC-SHA256 with the webhook secret as key over the raw body, then base64-encode the binary digest (NOT hex).
6. Python: `digest = hmac.new(SECRET.encode(), payload_bytes, hashlib.sha256).digest(); computed = base64.b64encode(digest).decode()` — valid if `'sha256=' + computed == header`.
7. Node: `const hash = crypto.createHmac('sha256', SECRET).update(payload).digest('base64'); ok = (received === `sha256=${hash}`)`.
8. Use a constant-time comparison (e.g. hmac.compare_digest / Rack::Utils.secure_compare) and only parse/trust the payload after verification; return 2xx once processed.
9. Official docs: https://www.typeform.com/developers/webhooks/secure-your-webhooks/