Verify that an incoming Linear webhook payload is authentic and not replayed, before an agent acts on it

Documented steps

1. Retrieve the webhook's signing secret from its detail page in Linear's settings and store it securely (server-side only).
2. On each incoming request, read the raw, unmodified request body bytes — do not JSON.parse and re-stringify before verifying, since re-serialization can change byte-for-byte content and break the signature check.
3. Compute an HMAC-SHA256 hash of the raw body using the signing secret, hex-encode the result, and compare it to the value of the Linear-Signature request header.
4. Reject the request if the computed and received signatures don't match, using a constant-time comparison to avoid timing attacks.
5. Parse the JSON body's webhookTimestamp field (a Unix timestamp in milliseconds) and reject requests where it's more than roughly one minute old, to prevent replay attacks.
6. Also inspect Linear-Delivery (a unique UUID v4 per delivery, useful for de-duplication) and Linear-Event (the entity type that triggered the event) headers for routing/idempotency.
7. Optionally allowlist Linear's known outbound webhook-sending IP addresses as defense-in-depth, noting the docs say this list may be updated periodically.
8. Official docs: https://linear.app/developers/webhooks